From cf5703b32bd5669b8275ae1882e385213bc22fda Mon Sep 17 00:00:00 2001 From: AskaEth Date: Tue, 10 Nov 2026 21:32:02 +0800 Subject: [PATCH] =?UTF-8?q?fix(nyai):=20M35=20=E8=AF=84=E5=AE=A1=20r1=20?= =?UTF-8?q?=E2=80=94=20=E9=97=AD=E5=90=88=20exFAT=20=E5=A4=A7=E5=B0=8F?= =?UTF-8?q?=E5=86=99=E7=BB=95=E8=BF=87=EF=BC=88P1=EF=BC=89+=20=E4=BF=AE=20?= =?UTF-8?q?fmt=5Futc=201/2=20=E6=9C=88=20+=20=E6=88=90=E5=91=98=E5=90=8D/?= =?UTF-8?q?=E7=82=B8=E5=BC=B9=E7=BA=B5=E6=B7=B1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit P1(信任边界):is_system_pkg() 原用 strncmp,而落盘目录在 exFAT(名字比较 不区分大小写)。包内 app.json 写 "OS.MEOW.READER" 时 valid_pkg 放行、 is_system_pkg 返回 0 → 当第三方无签放行 → dst 解析到已装的 MeowAPPs/os.meow.reader → 备份后部署假包并删掉真系统 App(无需私钥)。 三层封堵: 1) is_system_pkg 改 strncasecmp(前缀判定不再受大小写影响); 2) valid_pkg 收紧为只收 [a-z0-9._-],并拒绝前导/尾随 '.'(现网包名全小写, 无兼容代价;tail-dot 同时挡 exFAT/Windows 名字映射怪癖); 3) 部署前 readdir 检查 MeowAPPs 里是否有与 pkg 仅大小写不同的已装目录 (有则拒装并报两个名字);部署后再用 readdir 复核 on-disk 名字与清单包名 逐字节相等,不等则回滚,杜绝「身份不明的 App 目录」。 P2-1:fmt_utc() 的 March-based 月份换算写成 +9(应为 -9),1/2 月会打成 20251901/20251931 且年份不 +1。修正为 int 运算;新增 test_fmt_utc.c (直接 include nyai.c 测 static 函数)覆盖 epoch/负数、1/1、2/1、2/28、闰年 2/29(2024 与 2000)、3/1、12/31 23:59:59、2038-01-01、int32 上界、2100 非闰。 纵深防御(评审残留风险,一并做): - tar 成员名净化不再依赖外部 tar:mpk_check_members 解析 tar -tv 的名字, 拒绝绝对路径 / 含 '..' 组件 / 首字符 '-' / 原始控制字符;解包后 stg_tree_ok 再用 readdir 的真实名字复核控制字符(tar 列名会把控制字符转义成可见文本, 原检查会漏)。 - 解压炸弹:累加 tar -tv 的体积,超过 512MB 上限拒装,并加 statvfs 「剩余空间 ≥ 体积 + 16MB」门禁(解包先于验签,恶意包可在验签前写满卡)。 - 顺手改掉 appmeta.package 注释里「== 文件名茎」的旧语义。 回归:test_nyai.sh 49 → 70 条断言全过(新增:fmt_utc 13 例、大写包名绕过顶替 已装系统包被拒且原 App 未变、尾点包名、与已装目录仅大小写不同、绝对路径/ ../ / 首字符 '-' 成员名、控制字符成员名、700MB 解压炸弹), `-Wall -Wextra` 零告警,二进制可重复构建。 交付:nyai 153,844 B / md5 ef7940ecf5ece993d718ac1d9019cc82(旧 4524ce6b…)。 真机 10.58.215.50 仍不可登录(22 端口 TCP 可连、15-50s 无 banner),本轮 **未做真机复核**,仅宿主验证。 --- patch_v2/meowpkg/nyai | Bin 150452 -> 153844 bytes patch_v2/meowpkg/nyai.c | 225 ++++++++++++++++++++++++++++---- patch_v2/meowpkg/nyai_host | Bin 46240 -> 48832 bytes patch_v2/meowpkg/test_fmt_utc.c | 52 ++++++++ patch_v2/meowpkg/test_nyai.sh | 113 ++++++++++++++++ 5 files changed, 364 insertions(+), 26 deletions(-) create mode 100644 patch_v2/meowpkg/test_fmt_utc.c diff --git a/patch_v2/meowpkg/nyai b/patch_v2/meowpkg/nyai index 3d1b5ae6bb7f3c130fc65bebd370f6fc98e40a4b..59b3e17285fa1e3b66e77f24a1edfe8bcdae91fb 100755 GIT binary patch delta 48858 zcmbTf4_uU0_CJ1~I|Gb}Gy;x@Ha(2b41`1@60t-yAQ@}ql9~B2v(d;{*LBU@)-`iR zbB!%z(5nq=W}s-+5}>HL<{vaGD>W-~U9+NAjm*l*ZQZi?z0ZA~2S#i6`+EJx*Ld!8 z?!R--J@=e*&%MvEDctMahF-PFvG%(-%VCVI9J|C-9EiJ%G5T78VNAh4#_V{eQuHnR zgCf6C5&8bZ3iBVf%I`Q-sMxQtXd^!ca02ot9Ja_Wp{Z^2TYhp@#mZsmeV9VuXqMB9 zv79BJKFRBE7mJiJN=4gyN?BBjH)~kdP&UiUuKxW4Gq0|gG;7k;znwno>IW+BZYzoz zW(|D$$ofxqY&=<8^T~>ZpFG)oa>w$MwTn+|tvR*zPbU{IKUw`JJgV*o)Dv45pKPu^ z`KR?Kwgx*N-Sp-5s#8xqdg8?`pR~RB$%{{;(8=e+r|RlYwk|yRLi5S(3%=a`=P$Qc zpL}xFsTWtoG8Lccf1LE|eD&0mn@&B^N-dsj+|aqHZE^1b%KxF8&S%z~ta%)CoY)~g zd8Xx)ZR=F`v}qOUEyZZ2bIYGPcRgw%K+9vF{-qZ9Q;#qGHvhSE&7VNgr*#|k zWrRF1Pqi&aYo}J#_7tuPcQ&j?M_|UOWi6+w=YwhLtVuJ~&Yj}qquWl^Z$G&`B-Zr3 z)ncHrabc-Ea^#`I1~O{`AA%3+N=W@=z1U0#%!CfBjSMO<2o>nr{8Htzh(^rD2#)zL9Z(x) zIU*qQW=s*jIrx^~J0=SMmEGL-ZRU4Mc1{ZfrPacg;ky#wAf5*S(zliJ@ZD(oeMpy#CyqgrZkDf;=>>ObIuN0>CW~^*HED+%F2@0Ftn*~_uM1?H_qT+6a zZ3Wy5co=Y@9~A*@lN6Q|$JjVPFW`2-GC==ig;fHU%|(4c?O}y&0$d2VA8=3r^#R-G zD=fJWW78f{SOMU9zzKlu3l%oEPk=G?Q8WNVE#P{<*?$HBfGZydTjCjOtWlUsP@rSL zt;-ZP4bcAt>H&Jg3Tp+Ny8`tH|D?i>6XyWW;n}`YVfM?=E?_2L&Qsttpmi162_O-N zL=Z3ua2XY-$4CHI0v-lr4QL3k95Bhw*abi@;PKT88w1$hh=u_70|o&z*D91qX@F(xp)CQc02={o0k;A+0UiR> zo>f>U-~~Wi0$BbWI0dKy<^W~_mIC^kARB-u0ILAYpGSLuvs#n@+lxe93n&EK4tNf* z128TT4Fjrx?Hd$U0$8;L4FT2yE(F{UxDxOzU@KtK3kur{m;-neumbQbU=^S(2~+hq zg{1@9wt+Cf;5G<}ABj33W&s`otO6`~5wZYS1-KWm74SHqZ6{=+A7e)WlK^eIFsFcC zz!Ja-?Fy>^tN@%1IBqwl0x<3+a1PM+vcft5&jB(A`VG8-5hAf{pTc~A+X2S`mb`|M z0?v3{VYPt!-#`O^=Kv1@dJlk8fad{|`(wm!g5`kg0ZRcp0V@FQhalyEUchC5#{pXb z%iqE(0SqjA2Mr-n4`@rq9Kzev0Gj|y0M7vW0fT=>Lx9@>mjN~&g^&WWe?Uk9#{r%J ztOB$SKz+bLfSUllfad^90h8auvIQ&v3=Y8huR0E4pp5sSU;tYIj{|BSK+(`MU{VTL z_aWvEa2jAKAo~bH3TU@-RtI=EnzJUrl`)*{2iymE0&q|-&MpA@`@^IUge(CT0BXsc zl@G-FUp9cV89>wy?~kaA!l)eFk(Or@cd1v2w3?`&ME;H0?q}@ z9EtjX)|)wN2V7sq*>S*}ThI>R7(mD?Uu z2M7W@1K0{^Q!y|97E4jKp5a&z*<1>ec%{i9bh})CcvYB1(j$AumUj2h5X6@gaQfe z*I*f-e=3Ljg^b^DR!z^-I9m_65U?F^+;2HM3^)U@6Yvb6Z7_swIz|Y10x$>A_dAS` zo&l!;+Gb!%0Sf?E0yf@{DF8ekn283FI5CTZ3KaZ3rT}p6gPi#Q_X3UsJTV&$0FL`3 zXZ3)UfLj6U01p8k2kZoln}c@TjHLr60geOA1l$T(3fKwg2h<*hOaKPf&jUqBWP%f$ z04D(M2dn_>0Ne_A0q{6rk_U4f#2f-v%?DwCV-|2W8*m0-HQ;){dcZ?~n*ehj!D<4W z0C*g5;UW;227LpVoQCz^ghVC~rH^AS0rvt{0v@WtTmr5PLC63v0B!|5w*&+NCN0JK z2F!T^%QGFT22cZB2$%=B7qA@gP#9ARXs^SF0rUQXb^+@E8`FKrSb>ItXb0R6nE50| z4%iBK4sg&@nByz43IGQIo&(GQ-2XHh`u)rj8+v0;r(Lzbxyu)mZ-TdgOB;6*amQTjyQ!HV=%p)R#~H}K%`zb zF#0TN6g(md3o>};VllNK!#NurPXiWYthbjvtt{cS78Q?JZ0y7mv9Z7vU;<(T6pAF9 zltQJkMilWQuU*fpx0OGwEagiqwdj)a_aa|i2GP~?*GJ|P7fv9*5&7kMes|lH$1u=y z$g5yX+;)9GK5n^~dVNZt3(KKgU>88jzQ@Fp>#vCFY{BXlU-=S8!a}o!sMg+UkZUkp z1AZm&>IP_3eWXWw`JYyv;L9z`tRiY@^pcob8}dg=MLANmOmLKEgPR)b;{oA5}q8dISR`2Qrbr4Eg)?{PW3Uo>l~3YFT2fjUsZ( zkUwE7$OR`@d3+wp2YfVEVP*Z<_HD2TR1qJNso5x;`J$*P^h7rznY2S}EA)5{A(^)e zLJD$;D@sHcRO>AAeS1Xo4Ia;+C?sFSN;alDHlnD8q6Nqwvrmk^!8M`+$qTPRy8ulC zGXz8OD2TlMufuBTJ#LMi@U*g=FS7{i(x@fTwJ}mOP$v1HICw)!uf0fCzKJCwZoNLS zR|lS&@Ki}pnHTVsbO`oC??#R6CK)_Fgglc3;T@HfRRCoDTNo`>z=xPs4&3?(9Q9uT zT;ly==1vY0_+SULq>isw z3@Ii0W+CrPhgdZ{W%4p4?f?AgG&KRA^E3Fpz>m8GPh`^WaW3$ZMR->6JqujjKSfH3 zGdc;|=?N!AVTmW;LsC24Gah2d7~nF2D?pkSuBlO`0bdEc6e46%PeI_SFTpJXt`#^H z`ShVS*8_J5I4>a##sD8+?Z{xCT|8tW`zY`l@YpF*h006S;(6rnKhr&{c@cU@c9@Kv zf8*zdH1IKU84(RW z(et}44~>?>5!#pV42?W<2{!>>2K+eE)g|$riumZp#K0k78^1CZHZrJ%6Tr>-`X~Hi z7pN@oku4LoNzfqsfzQ<0RTZhiY1lc)KmSe7JX4)g;Mh41CxvWZA3{+)j-PFR$v;>!-kRu>~#oFwf}*{%crw=%K45;_Z{0m*Nz~F z_rk@*(%{m89|wFD(xxy_?>^u=E{Ksgr9}IYjQdecy~*XQLb9^!;#O3Yt_QxhOFVaz zGiEQ6`APNbJ92z2S3u$3;+{UYLm715MK+@jAZo@pMFfh)0Cm=9?p#?(zj zXb$ogA}^BLgr_J@6Ywh1<^ZUzig*^y_9LT-Ow-^Xip{nf-NCann$7>npC9T1a*xK63fBChylzw5n7SHXzG z=OME4Oj9UHM&6*_U<AZlnk z@aKTPWF^Z$lhy~(PAYG7Ks-N#@}otT|aR z4+S>GcXuLvWfg6d1AjDLj34QYo`s}l7xP9s0<~1yZeevsHzxmyzfH(1>)Smy-P2Ba z`;ga;ylSck-kbG+W+$j#g25I%6A#Y=*9cq%(xBRO;f9eDD`g}ZF)mvoCPtUZAiu=j zA^D>C*~%m_;$}~v63He+$;tVp5A`t@xETnk?;}J-e0`)kB9^X1e%^J6@lt-7?llm8 z6Yv$lkD;zBbUbypANZ{Whyz2G@L!#!lFVY*@`QD{xbx<|S?7^|VWdU(LQsUp9*4-< z1cZ#`IPpw$QMj)CW|2{r6756Mdy5!Z=CMyhGV@*>3ec>V#QU*v=zp0MjXLC{Psh@+ zi0L<_i1spTemhX5_gmO;lttn0sUY$xsHe?D6xzrmO-kfbkk2<${8;80P4T^D4_Vj@ zow?n~L3O{&06L;k*p#e=sv1GPxj&qD;CnjMGzRfHaC zLS9MG5D;V&rR~5S0!~GmMnRMkp2CP{FToQtDXdsMACpYw@u9L-{8zp}l1x45ji|^N zgp6qmglCj9;6t+M5o7Hji`p6k+!^4!NYjUKmB08&Pb{9JYWVuA?jUGZl^-tXjLAnbn@;iYq2i_3+(o6kSDieoL z=7~i(HbENW%@e^}k}ADGPJ7hCI&|bks;>-rWmVWU=#xzjuDM;5+I$-2{~4Vcb$Nn~qWvN^!+4QGrd!NLt*zex+6+J+L46*}xAnI*Zh&oyc2O)2&atog@m% z9s=Gl@#)02B;eAQ;HZU&!iU;U2W}Q{1>^)V_$MZ%lv#qzR%Dh^>4+6Ujroyx9(h5^ z!v|buvw)ku^r!P$4g50T&FP}H>w!A~96F}9?WIqP$I4?zZU~MCs3D1kynO1 zKUKkpaA$yP0#1q&o+U&Wc%Kj-l&ADkk@POZ2*mvI#E}JfnvEx^oGxj69P%2GS4%D9 zLyb=ZE@!!=+aIIZ3j#N7xtMsX$JIpHVS^qF!JHQj#r7d@Sy-&Q)fG64WL=#_ce;^9 zBwE1&>t77+!6Zkzjg(K3>xKU%U(O8GUxB*}C`&VAc1?MH{O3pBG(E4lJClY)q3`|3 ztfWkQXxeIl%X#wRX(J-m178k&75uXPBlqFyD4vK3mkPrPd`4rp%|i?W@gn{cC|&>v8yN zv`PI?%>5j2)C7Hq@~yzdHHbO4r38*5S=C@@b!5?iDeO|Q`r-jobt}T_LEsIpUKGnx zk#`(b-hXtB$Qt9wtU}Va7JQ(^ z?T0}%8YVV3B5(FO=tJF+N;fry^AL5o{^Aaazn#E0t{2aZaXIaX_$NPStlhGB$wF$A zjt>0KiPK{|fiXx1n||th(2(dL;T-aa!!+Bb8L0x^`h2&RmCaK5df;<_FVV|)8Ec1M0P%8zNjxPL0*1%4s$1v;xb zEe0E@`7-?1-YVk9rra_O$&!s0J&sq=GpvQc?*rb8;^uIPOgaZS54?@=_)u4^z_B*C zG9vZ1#OwFtX$+o-{bo%nbprU=z#FTuTd&G;IP5rqJfC>>)`6m9thHA;o3?hp4{*T%&p<-KGmO#@d2Tpe)dX${~*vOotswJ&%3F_I$ceG~AlFN+7q zxdO+LJoMU6i9QGX8Q^oMEqtgs8;)_**SlSPyQxuB;QheIMRc75+_X1-TDA=MCg9Wc zvH>|BKahv_UpyWm{;#ecV-48MxL6+)Cgk9PF_S#Gh8+_5rsrqTF8K%HBjd zgGefO^a?NZ+#!n|a0G%zNrzRl-s$ocW@y?eD#0*V`sn1IJvzR%4%f!rIXKQh6 zmIqq2=E)aXoIBmet?U8M_g&-xV4H@jf7!y~Du1nMoTX;OFqKHgCkl5El!D3?EbdH( zR=w#j%%-pebdezOUW;2ha7rw?vp8_z6q;3i{8r|ZRjJy2QIxIYUy8stMBo#Yp7J){ zQ@%I?KT39^x8sYzKibnyfUk|n_^2m?Z;HS_tMqj6Lj=B0M8|gCL(sa2jx!_h1<}Ja z8mt^#x}V>`#VZpMtp3BpnnXuMQoz}$FF@j#yViFRAI}fx@Rhhs%sR3MhrOwq zmd9Ju+EL%FGJe#6QOIYG)asK=B~``fx&2))mRAzCyh=eo%TUaTQjltEu;fk77QeeI zDy2$I#i4NnE;1+uWk_pAIxkh!+~vBQ^-tBj2FhVg)iROJV_VXw_%U(dt}6nsf*`lI zgA*Zc4AQoio_)~QO3f99fLsY25#%;z*UDl%ZnfQ#!`6j<`4aN1QRt;HB-=`Fw_I&K8vCnPzz&rCqm`2Hzgw{ftJ_yBp}>57p_aow&dJGloNuD6NlCPD453 zA`xVkQ-20Wc?#R?85EI6&nA~MZ1eexT`_8s)oS=G!4KljA9`O99%kS`8 zhk9sQX$2Eh;@!QqxLs(>%lM|hh!Orm)D?^TE{ECuDWeH0p0i2p^gEp1m|`sj@*JC2 z1bI!6a!1_0plTR}_}cGEscoe(_v#*06#N4pqc(}`$+^7kl$bi%nX8v*=hT;5t>;mjbnbuArPFq-O@F=t z7duQ^iB*#w0itD&55K*%;Sw|SV^dr0ClV2o0fkJ>QXB$c5H2dz}!eQYxtAt5xSix^_ZO+1>;XvxvB>5GMcnu{Et zIp*8@X&T|(>H08Ck$a^7MR@UMg*)(O{ZHErfnU@%(Up7&U1lHD{%=4(vB_-TTqJ`W z?ua#_=U+NkbJoay1I*+zbvQesW5<8#Sc@pr|G$(m3CWK)3GvDKB!*HycXzi@{=Y}~ z6bcf7G-{F=jTC_DReu4otZ&AvMJ<2~CUfz*wq0ZkI^8 zZ)7ZUs7*w_zHa-_T6vc0L9KYjlKT?76#^AXg8{yBr!LHYGqr2b$MUR=Y2#okp4)*u ztfW>WPhSz@)P19Q`@15)azsF1#vM?Q?NHY&ZZO!*jndf2)sH2shCCX>{l;*mQdND} zT&xYXp^g>ue3{uh43B2uqk&J0zz;I;QNUlRFQWjv@=0ckVxv9Ok(HHr%*KhBJ3-6< zvw=FYDLzK{yMQ;XpF0@j?)r9%`>e_pcB`gqEJ}~i-03QJS5Y37VH|5b^rW;=ey;bM zoLE4KXb_Mo2}#6Bdt$-Zwc?3iyF5B`e8e1hj8U4~TQ3!*JCATdnB}#hM?M!H{Ms@8 z5i}cvaoJ6Bk)15FAsWEnj@A`coC&KQGL@<%5#=OFa5#qg%~cYV!m z&{~GV6uEfi%EfT`uaC6XPx6#N!0=P6x7QKP)%@UR2o_r+0#6+ zvXi`evRRX-ZPC5&^dL{^o*mOUt?zcDAY6uv&<;V-o!lN=2k-q8T)QROz?ER8iy)X( z9tJ{s__{%4{Jkz;jGU7@R*F@>b&NFmng{nP9e!N_d#2kLBwP;KYHrdsw!<(s1;F>) zsN-l6Xs8$1D1Q8HhDVMR>chtxLJCXO09(wiTe@wr7&YDDqM}3KF5I_Lmowc&Gb|O| zWNlK#qUre#Q?q^_t83QTj&*7GtrSP58~#sKkUeUQk!nULswHSxS5!lP*B=5TM*c3v z&@c=OrpG0nX^g8hzA?=Ud86@?C7Wg7X{@CQ@B%Pa_|`0d=VZ1{8rPTsrVP;{R|;8=afEsJIWuB9O&6tRKWkQwshCgwp&(<*mRe4 zu!w6{p$_#m39wA*t1}(Sg>d;s|5)wPlOiWgfr6sEM94eAkEp7C!*_!tAwv*}|*KSll! z>60GkmUr82l~X?Hn#lZuIMbX`zL&}_RlA|8#GaYOfk;DAXd06G9-W?#ssTf++-H5P$M}%$_A#oDJKt%PHwGl= z8|NS&ZqzA_z>P3)z8+kFmm0`|9wfinz>y+18@$E9krgv>zcO&7(J#f>FUHBGUS@$l zRHC#pW8db^v$k8}SBdCZg#l9K#2? zR~S|-(qaXF#$uVcNQ-6Se$HYAFR@rE?=U87`qR2V48qpPZSxE9$9}XCe(sO1gqw{l zm9=34TSGTLEk5{Tirf^E&p>NT>U8)Ky^OU(#i+P$oK(K0yBCo)XX;4Of$ls%ABmO~ zX7`x;M_jLxnH)sx_o*un8?`cu^&{(HA z5#;Qcv65&-pM6Zu#)mwGW)W)qO~v%JRc4^~y!${{$AGppIS9mp2zMq!IOa|X z#0=1FvP31Pf;D=~X?RSkR$`?81ALy5-h}cwM%stClo^D24`nC_MeQ6!I^9Sop}ZNp zYDZc%@b~p8)WB--{oKp3ix(*mr_kKxKI|MzgCb5>z^NFAiF$Us?pSI?8OBI8D874G_XbE=ltwfX zL?_e;sqjM^OfN^}q`oN*Q)XG`>EsQQJn=2*<2?o*S;u3~NIu+At~8tj~lh zt?M9ZJ^557Pk+7{+o2$z+xMB!?7r)yt0e$>!;@hB$#5QHV)1mL0;0&zyNngVae;%=@QS)8=ng%g*z9+)d^c(8Do?mXzLba%c z&Jm4isq0r8fvtL6sVmZy3#pk885<;btBZ(aRF$oNN60(U&m;(RPdd&KCiv#>F(bHv89HaOgL3S#2*sno+7Xo6kK zI_wY~gf>1xXrox`Y|!VH%9;CziTzDi($8IMNYoOgncm#vt_CiOiBTbL6fzq*Wyl-F zVj~+d^RKp>o&0=$NiRKLwXRE}`n1G)h#aUC{0j?$8kY+ZTG8ypD;6*8pJj@qFTD+% z3_>JzuK&W|7gI*V_jv$8ecC*Vw->r-+w<*0rxeCA%!wYZ_wg%?8hM_^G&7Ei?Wmk% z!d(xooabDdc9&sVWIPf0t5)|A?Tw8zYKdA#gi*U>aMxASDCZ@a+|ljS+ptr4P6!3| zTGCb-!gnQh&@}bB5Q&3-8o`TK3&$cSjV5=I(lw`*#Ku{AX4q>%1yh;{ z;MP>zx-`VwCRSzS{$W5N)}0>wRyiD|?(XWc zdro)Zh7tq;p6ThT4BY~D^UEYrWc)cL%bfiFMn}YVbMg@_lLA3=M{Xs8$TR;uB0xb} zT0M~gWEwD4jhy%F%X;Kvc!X>uK=8Y|`pVU3E}RdH-F=>OU0P&Y)Q@h2d@{DbGPm(& zx$ibBKAmjJl%G?>aw?_Y-d*9M^1Tc-;7eaeVzS^d*GRLeYapI`;;>K?KN!)!q zDi!SD1#~)G=MZxqmwSXK9v{u&Y@dGINj_6-we*=h)y@&J3q<`g;iga+)AX5+#y5s~ zt9XMher-q(%CNZJ>2#^O$44R`it52fdJHXMMXjsOD3;3)a<>yK#GAX_{%#BlcKf^k zahjoyAdhV%R_mK};*B*`BrNU;)(q&a&x$W`U0Q6Tn7r5s*1#NJ_Y-rRPbxbH4Vtk( z^YCLYf^LHlJ2urGvlgXi8lDy5A^4{kXB&oA<+n?kbcH%Q3RUTaK+_H(EJ)9$XKm^_ z!jbx+6Fxc!8Dzt@z_uZz*>;6&tizIS+abk=4j=vlOED3Bm`)7gHrTXb5{cQ90{uFK z-aHAR!Y01ZI3dAwrA=%U2Wve1wHL*=H7sg`6`T9IF<5bHJVbDdY z)9{VW-Nr-&c}U%CH8_y=l6XCoZ*2PHS>T(}ys{+UN%KSDDzjyx^(exAOH0m;n_Ij$ZfeQAv8^Tj#*Ho7jT>6j z8(R^0m|r`Kt1=*pC_Qrr>lvc)(gc$`MQ+voTvvL*lC^2Ht|;1myMe1KX$Y~isa_W3 zIpy3%$}t0Xvh<_6=ICsV&RWR$(m9Ja=6-qR;?Bd0q%#+>TwIYK^!3QIS=x--QYpRW zJsO?NnESbvAPeUF3z0%DX6&+*07bm$v}L?;&4G?7h*j(PFl>-Er&T6wN#odO5-sGG zk;ynl`+>Z6elstZTAfUXj2>Z+@GnE4OjS!)8Hmz2lNm_U)No8q4EJ3p8}Pv^kRA*tedz^}2PSLkJu8Fhu$l@HB!2trw{Y!k+@ZoV@@is{?&T1$19FuiZkK#Q5uW z(?oahW9HTyj(R0R#Mq6tv_j{YM_pz~0abwrM`>Mbiud1Luj2abN4O@TPlMI=71M0PFwLrLAeObuiZ`%^bgNM& z)%GVeHMm}3YcYtImOf~7LU}){QEBY#S_M^Go~k#{k6r*o^8?C`WAir(#~Ts zAUZ|q15T#e_wcT+;kCHcC+kJAd*xudx{9?SwmkuUUY=z6>dnf!DOwjAYzSjId!a?e z^_ZX*X>+i^5c&)0to?Uadw=2x0yiO#?IZ57&u3}L?R-e`y#WyOt?VS{*?ZZ?xk63M3xEUdT^*1{50iV$TvA%x1S+ z^hg@1nKtOz%7nFP0}Y3BT0%o8n6NrDfEBR>9C-)q80*4>#t^s7pOI=W!ps(>><;76 zO{j(t`Czon|89kDpy{+ltpAx(pP_q;&q@Ne(dx64ns&oJ-A_sj$~21Eaa`ZGxiX<1 zOH)6Fd3+n`!Dy_UTV=x)FDmKr05(i=-ZN30S$Z?G;v?nUz#AIh{Dau zY;_AFoS`I$hCT-UA}8(C^c`6c?hLwsc_q!T&RAfSZ*H*6dv7#p*kA=@xTFU9hdSw* z_Tp*_({XM!eUm$cxh9di~*1nEl1O&~2+|+RDSX#h(v^Bp|ON2<2R=TGxaO6-{D-l6yq;vJK=FD1(z72ac6ALF~{!^2BkVlC`(5o`mr%FwWxNmxyYsZ$HIr6q0?sC zU=x9KHHeOp5o(hIcL#7RJ=k_DyMehfZ-A!hT}!c3SWMUqJ!p&bc-z}(NR=0z6n4U+ z+ZG?wHKCuI_mAiRLE_L++_SWHZ_Q+6fx!{U894mE03MXeKr;~(xB=Sl2B@~)u=5vp z+<}h&j*k0k)EE&Uea*}Uk!Fq(@|G!2O7y$Jr0Pfp%?+Cw*)D+vrhN@{Y{kgwJ`Qm! z)~*CN#cJ(vSgB%xaTraFMm9t)8C8ZIkOGy124!?2y`5iUjEKyvVPh*pzKX7^ zu_(}=J3Zh7CD9rMnHhr2q&eL6x@vnU2B9BV)_EuN`%!iy>_H1Dkt+k(4(8+ajG%;IA?=21ZmqAKz0TQkCfk6(cD!G7Htrt-Bq! zu&G^&j0C+sJ4rG+!xdFBE|>|Q#gN4y#!Kb(=Hw-->WJnji*7d2meGwPhR8sRIq?*p zC})jngH17(;R#X@KG;T`4OvhQiJ0VGOy6=P!A0*27hM;E8PbgPV?}{lY!W0gk=+J< z`wau{#b&NPraaKu1k4?=m6w$u$WJS2#| zZiE9-8r@66TQ7F<$A4t)QcXp%b~&kJB#EhA5feBao=;``1~mGN)H)`I$`QuVkCauu z$ne`+6B|O07?V(^z=Ji?%aqljro?ALo`CIRmXZ81jA=z)t+FPxK5<=WNcu~7UJI|Z zf&E1Z8Z)>-20@8(B8cL#q$E}v9nola!zKhX*I~oiAeTZJHl<`ksBF-?Htik5l@5C8 zsKC$XLmLIIhFHWHY=tXSYXya*VYo6(a$s=XF!(Q%vVJtCi5eog(6y5vN}>%*NUhgH zR`vXxDHCN3k zWrk-D)+vSNDBp_w%6RkmNXP51Td2ls7d~0;G<x72>-}zqxomr2@HhR*}DHnSs$XLX1j|oE*psOKXoGR zga2w4UT|^Yi^}$bdr4d(c`(aA_&>^1S%hZ0+y0F#8~8a#SSg_ER#bsPw`Sva|Ch#p z;>SV(nQm;U>BeH!nC(~%S&|NTKwipbt4n`qM?|Wh)K=ztB}bXG*`-1>M1{f^@sZ`?m>aPl4%KeaQf;fj!_-=wpGyTq z!KLrIhRbr>{~FL)ObuR(5s@%Sp+X?i9KpvIetzkh#F$<18z<^uGn@oTD7*}l(5?T4P%4izGo!q(yL=PM z2YzlVXbO)xl8121(>W8%h z>jkSOE@SnEfD9Jjuf1j>Nw(=N>b|y*(_FuL!Dp0H3Syu!$s+1R^|1DT5k=nV{hx^i z>s)p(Vh};?nY8QSw*-I=2iGgf*ak1H^)MgIuU*Rm<%8L6(iF=;V^t7q*oDYsYVGB0 zm?Q)TS2AB=n&)mv{nK4V9x_@f2$S|fB+Q*0WQPn~EO0PpQu@1CN%lKk^EE_sGvNS9 zoQ*9=l?ldX)^@R?>@%1zI44?q6YVJMkZ!vcwuh8t;s4ZjH%SGBlX|LmKp*wIjsgV* zkuIu@F&3X*-d#=;-XRC2J1k&IwIMf;+wNYZZ}p`Gs1XN!Cq-52q(T*DV3Dn8`dh`_a_ zWkLA{a7vK~KefN%r^d41%eIo>7pdZ@_5A}W#yFB#3Bs@UcvT1&UZq5-B<*tcpdlCY zHO3x6_|=~TVPo)ujh(k2o)mUA*bwLf&hT86o@lg5VK#Eh%okO3YE^#3aB|l-v8ylz zNm>qWla0l6;KxKW>DfH;BOEaw1p$*Z;rmyrxaHZ)5@-vW9Iw0m`U^Q?`m+wFEoGyp zt1CK(b~$vw_J}+ULf{gv8*T}#em0xG-z1Ja>q)SsG)n(zUljI4xQg;dvxt9ggu|Ai zADPtRFse*R@X*MRHT5}XiY;X*L`5k`pezfru466BX zHU7pHar!xz?B}nZsZ<(w(|@M4-v1mpx^cbwqJI@tE-kCBCPHrHnnt(O54Iqm6EBJ~ z0p}xc|OH z;cc?=2c8$XP4ZUC*rtqZIuokHPHC9w71#Rkiw4+`fZgVKka@^UQiy2L#-@qI`jLX4 z4?$?4t81vIcNOiPp=AC01& zBexmG8y$y0KnR3{Ku`#T$tc_GI6cZ{-p!cS{azj8wq{-Q-8em3Ec!GTq~M6)H^1No z0rjSwAG&zKuU;Xsq)5|$)-wGPaafv~R@la89979<6XOp>>>m_p2UqL<}#IckT3-_q)0hG`dU(W|KS} zYaPYUHH(Z5*-qY~H-q12*Yp~Gd6k+<=e3AA8w&YVEn?dS7x%V^4>maYz!vf2h7}n! z1idG6=GG`VJX^ztoL+1(;C+H(0LEn;%p zWBjgj;)^y<>~2(~;UUwxX;Jq8b;Y0=B>Q-y>>7iFp27fM-{gt?Om(`3$+gu~58XPsLCF{G7)EF&!^rd!3E{O}~s{VT){hCl7Uze7K`gyU9X-hVUSGKt# zM$PEr$G6*@<8?*JxDP?O-b}arL>yhx&Wm1~c9o%1@}e8lbRUlKYfK!<(dAh4O@78E z)xeLD(GT2~nf_uSuC-~>Rr%1kqiN++JWIe?iiAcIt>O+S4d&-ke!dkh37m}l8r~>9xdqn+VG;c8PiO}G~&J-?k?$f!eOMr zwW-_XP2MNA7t4FTbkl}P>bDid>Fv(=ZX<-XJlK9b{_W@~zGv-^3Wj1k# zBlcTTGq6MNZxHi#WYKM<<{i_W+D2X0beBuzICqea5Uq3ETFT!!I>GR~_*aH6^Wa9Y zYNz?;oyzHLIyWRW(b)f`2FtNq zGM{n(QI_lKO4N?xO=*qo!qNN&aqX_5@**U?U*2qtg7>kq&%PG(b~#2J{StA`8)C4T z)|EQ(?ifrRv4CVdvKobvseEhU#pU1bE-yabHIgs+Tx7MU7_*^9&c^t57k_StnAe^W z`wx(!;MZNq8)%=HVp@2mjV2^PGa=?HV|O+On7G@MLhcEff=>+|5wQ!gN5(5ct9Fk! z?gvKps2AU7`o|D}XjCD`jn*bPgk3j8_c(?1Qa}p#c*rZ8vgiMoi)VIVxOk`bNEa{m zB~P;Hw#}2|=wrmEXPiN{_(5=*<}!T9w;_a-s* z6%YUVgjfn-8!xuK;-U*&AH0$sclRc9gymZJ>`Vpz`>S~_^4;qoTatC-vzr(zs`(MC z--=f>2zUNYvEtQ{W4#kxP3zfeyk(-VJ<3{v2G88-YNE7vg4)!GxNvOHE4{gqcyT8h zo3rzG79&cs23JOhH&GsyJ$I)Ub$G$qJ4OCJr>o7N>+GGwo1R4)S4Xr}o9QnnG^SNU z-%Q23U;A?78&lob=IDF)O`nUM`)W978}-@uD?N9UcG*06vv9sKf~cJG#^e<8 zt5elU@To`F;O?8liYu?wAhJJxV=P~WUnAI`>)f{)f3?Hk06x*5KO%Bom-oJHtYPuK z&7x+17M0w&-<5A4p9)DBjGvn=!LKxEP1rKR1t_kLW>IL9EWO-Cws^d~jfFdhV5)c3r1sZYu7+ zbcQBZC$SqL#=KyAYBBU;>ayO5Go-3TEL>ls;41Me3Hda#b%(5t!k`FOAMs)g2v*_2uB z%P!v_sz%K+c26~W(U8}C3j1Qg_#z$_paloorhXhGrY@sTTguB;kK2GcXV2G4Y>aaS)i_B}^W&O|a2+lVRAmguy!quEFy?Qn$|%CK+Jt(t8nuHZE)8CF#xQxg zksKN7zn9TJe&IZU`lsn2*h~IoDP!-vpex2WRxk4p8P5nI<2i^qec(>dP9VFwHhT(; z%I_J4%;y-RaUujm)IPc--z3n4O$L*vzaR?V9qk~RawcfnmVB z>gvO-V&32L1Ge#dpmylcp#fK|qP0_01lOEt5A$a^CY58hi)KYuk{$@=$fGGP;>!Q- zLo7O)OMcnTqpmnI0zvf1psQ$EF8zlU!D12pkD2`Y4l(B+PAa(KAGv`Tm?a7~(HhK| zFwD@Seoitz@t<@W5rw~fq3a})3i8a%VZek}kN6w@W*Tp3A!9h1|O{ujJ5w16OX01%sYRDXqz}N7=Kxh z($r5fuWxzyGqK{BC!RflyHvqC9Ab!-CyJoN}v`S@$w+P;3zp}03;?`uQwgg$X> zVQ8JP0&=&R%X(qRErx#3KemkRwra|{mItx!c5^_cJ)2zIcCfuLq3cABtO! z_ZKrhDEXy15G#0SeID2Elz-I3?)wF+Vp`2I=B}w@o*FVv)Nv&5uf`@%QyN-+Z?yPk z_g?ZL(Hi>R`C*o)6f8@yTea_`miIC2AM{s25X-^qx>Bp|%Mb}2 zE`BsaSSHT_h7|9rw}Y9nS>3YKA^lcTm0 z*ZN5h40}>nc5e%@dkZ3xI2SixW<%g+QPi;tk;>X2 zqo5brb&^vCEk+dk!7f^temuKz)IxdehScUUNcey(2P^@Eat(dEo!Lr}mNR6hU!-Xb zfeRsUBLuF5z#S=@RpQs3S3B-)C*8w%{0?&5Z_6Y*a{Ug`+zEkd7Y92Xu|LWeS{VPR zU3}45sD6eDm@MYUPrWTVt)~f6BX0YxJnVf|86+w{P0!Ms#yeKBY5I{wUQqjPQ8g_u zYN7VslIrX6+8w3m?GQUZT`+2sq(d z)ZT2+%dFYCv9&H3DEX_GW50N?yQ^!BuIf9*2VbPb(~_w*mJAw+{xXBw%KmbW>mPa# z&6g^S=v_2gu0`(>2fv)2eKekYQeLnrz8KI_0D7@Rl;+w#lQj76&1Cb+`=nxvrf=D> z$C-ZCVSCFERdM$DWYKswi8kEZ&Q2YCjcmQ5K5v&UOZqc5;A%blhU%pI#ICMXQTbI~ ze7P)3_K`76WAj&8@qURKT~Dm~rd^!=>PW0EGq7B{#Oq%d(wxP9H>0)Z4Yc`#dm4MDMP=*go0jz^>E?AU;f@Ef&5A!anrF0&$>&D6 z2DcM~5;cL{f?P;ALh3IK09^;-HD7^{bNSNK_}7CYbn^UM{~dv#G^Qsoc+y=K_`L3V zyk;et<;NQTMY_SngJEr;_;#%jz2m%c0Vy<@fY?a(ts zdzV9eu_RiQpC1!DU^lbj3`B^%qWQdoUuYMvoX_PrQT*|IaqP9ogr69KK#%;-%#pX_ z(Y+p00q)Gjp2qZ@?vnzJ%PVYejV|;mFEiwn%*p=UEG`q}$Dmvs&N`tDqQCR-H+PGy z?_B(g-D322*%V({^qn(6t|;B^#F9!P-X-kO>&}+iRcR*4pk;EezO3cKqJGIccA+de zOALR^*<5I*ifjk%;8?eBVcJg}Z>RB)vm*w7-#6RD5v^u@lMekpI)lCH=>v;+%J)+_ zmgL*tXY)^Yi|7lZ>1q6hTpqVaEWI#-BlvXe!cx)<(|;J5KrV_qFK97c6#Ut~*ME2} zmL7>lJkI+uOFojB!{e48Cv$+5F6Zc;Li&I-%+FvPFRKU)al9zx+XLaU>qb&-Zc{klqAVi(9*Z*3^#%su zt_$K%Vx-oPQ$UV_7sd*=I^eyeHnY9qVyiNfAB_)hu_|NvmY2fuQA!Q})!y)`C?#t& zEmfil4i#ca`i5$Tp;z*lz2*YF=Z_Dq)k?osO?mW8461$i;^*^+={f9-2A%h|hsQ=M zN1z77Suvn@$>-rMF^V%Q?PW}fPae<8DJetL0M|KWTAxP7Pwmyci_2dQbDNUQzuOzm zwSfm>Z+M~&+)sNsJkO>~hRYHD*rt5V&kYG5>7|V4d#?&-$12-+-OJ%GVwJ4emY4O( zZFxED>8%v<6T8AwdZXU^FNa_6t!(7JSHkn+lw$tYf$$!JA07xt_fhgwN?y_HjR16? z^<%V(wio{Ch*!en`zST>OO1TmkS>2E{B0j)D#6L|N>+j}@|IIw9z0_JLZ4DzVIt{WwN9ARc3=j*b>CTkvBS- zyJ_*u;ljSCTl{Kxa$m(0c<*Z#cQz1HFrS3&$iVMemc?=75ZnE{cU>xehGj$O5PLoZhU6z=v6Q|Zek>97j(!<#PE?As zD!!t@pj`}14hnlnIY8(FqVo`24@dY}9AiEgLS1K)lH#l$(zCBT4^_Tc3XivGA81c~ zBRn=qnZmz+J-jms0(tOY`0FHPluI8&2hX+m6KGK&*rYLbW6kxJdg-&G+~j^rmP0qU z^`L(k|J;bS|KUJ*T|ecqvERQAL9w?hE8%ccU*;((MUe~m$++`y#wow)H4@HP z`~+c8nhJMqyTT9*PBB!odxnocwlBQMp=9LWLT|9FZ^xB_Vji#5V|}9@-m*j)R*NxS z`3AFL7lBRJnh-rxn) zh}f8k$*p-KyeCD;a?yYl5RUj>Z4dFQPF+E2P#YBO$L^LVHm*I z1C^Z)Ir&?Cib){d0tHd83{oD;cnE!3S*hI9$w4AdUkwnJ?iEsxL5AmCu1x2XUk{(Y zT$wszqsbJMX#(>|<6=u!dkf*$5B+~I=wGW12CZ;Ha6!vXC&mEyqZ5o;c`!WZ3QPbN zzzTwR-Ub-Z1*wA%_AUi&9XN}JD~^>(g2?cqH-4UIDYk@O7)I%L(5o$E0L^-|MPzDv z9@W(s9$ho&@Dr4A=wsbt09azLMf z{ZLo890;$vQkRCER~k$hoUXB{C_|yMdkET9g}$UBd$AED)e1=o{+KYNB%F|;xDtA1 zd#1st@Q4gZ*H7`x*1N8VN2tSkN;8~#ywu;$NJS!W(G-#27?F;|%k-u7Hh|t=L1m`s zuS|shnV}5ze0D&eK^u+@=!fI}Ef3FzdN!l5f{i>?=)WbLKLqw+^MUZZAxd`OHRO@n zFdHQ3KsggqT?!1C&t|zuJhf}$FNIW&f(R!5-(9P<1Q^#i-LQtQ&Q$vFrXepBW-4EB za&@w{hrAgc?Nz4B zd@J(JeepP0R0^aa|Cm?Fh^6}25EB>Thr$Ik-KOEdo8B*im^IOc5`YUcM-azv_M0o8djk=U=}W&Kial`1iNN zBZk4b+IvxbCqMRPc-1h)GIa}@dTBc((^l@aEGLkQTGwjNN3XMG!UYY}E=kQhG zuK^3D9)jSW_2CcOk-Dmf-S+ccpcXq2)IlC|YE-6#t!;6`uP4=c@n~*EZp3K9gL0KP zA~hpdNr|0uKCu;Ul@2pt5(uA6%>ChfA(i@+QBd zt9Q`U5W4pI!fUcyu152t>}ygO4-nt? z&K(8B3mM}ep)p2?;J*mbAv4E8RH8C9hRPf>O1PP0$dI9u%g_}6WM-(O)-@|6M;$dX z%>RglisBz4G(N}3yzjTpIhT9qy?QhAz32DgK6~%A*Is+=wbovHpLO;vy+ppTBG&pm zU`&oB$D*GLbu=qhObTCy(>X_<0EBoOXF?z9W5<>cxCWSxByhCFifHRr5004oMeJy9 z%Z_D(*>;23mL2H67}t>afTHxAnla4&6;7-w-y52eS5?o>TUbdC5kI_E&7 zBv?p(W+pI!?EH8WGVLq!ix=TR?qf@w54`Sv_8j}sn0PTH`cEbv#>vaszs}RXct{}n zxMHS$gP}areu5srj6fa3P9KbkO6ccYI#>h<`R*Rtn1Cf`#1R^uh#y^j{0KECiV@b? zN7`pLeu$W5ebdb6AE$~TBH4PzQy(xCTf$yPY5GtxCSc?#%pN@Q{Ns?Q@&vXFhlWCH zV~&z-n3!Vibd>Q1u{IYB1D;dJ4+PVYujBj#yO)^X<{l5|!$Ev+%QZMY{?Mva{~qYS@+ieV0LB1* z$^#~>h&LNH&nd87!R z;$AP<=?jHG8#ofnzQwl9?Z_fPAC@R;fZi4#PJ5TT%a|sff5zjcLvg^P03Xp;Y>J2; z@^gK;@fpr7pI>V2eS4QN%_)%8c=RQde}w-pJdGFyzN8(e%uymf#!XKGX#3ZEX_w>U zqeNQJQ*6;g67(@&Y*9Kp@;bytw(4aH=ovj4OMyuTFC7J=#pv*VuRppyS_DRp?>EHm zz-Tx)L{aR8+&1jL&DrAS_Bk8!d+dD1_oM5-7rE9BCs>9ylxZg@Cl#{U{RCB{iqQf0 zp*&9EFn3-R9lXg2dI(lL@&qk@2(q4rdff-_9wHr6-+sKn zV;XdcVjh9k(%;5GM^$*gLRH&b&@5#|c}+-jf)YgU3{f;}XM@VEF3)5dPBt4?NBL zg9r)ChfuTtp||p2C%E$u!WPW~*6WHAaG4wv?f~H|3<>5gRcTjZ-pPSczT-tiI}?oK z6~OOEP+o7Q5#vRWEgv}b$u&>+SuqoaYH|73DR(>!9Qs}}9>T-QFkS@aEx@F4pFd?7 z{v89wiYo91#{s9Dm4p@Kr0b^@L^ndZQ8Scx0lw6UV`3qpC4Ur~t=mqyR|6W8CWcsx z^!%M{eOIQ5};n8N&1W4EZQpV5|DS*ql!1dlmRweCLwze%?x1Ct76=XP!i0q_!^Gln3lkguC^TdcpOEHf;IJ@5Nd&F|m`q~;H0e>8 zOK3>Jqu6*F(prgt#jc*iF+M$QH({0LGF=aoSgxBQoH5~0($roA)_Y(>%tK1_3zMb8 zq24&mOlU9T@vsX4t-4d;qgh^K@cvlmI#hOaCU$8HYH3O)e5rR$MnKZrGDULW0W-hP zl^Je4cVo>-dkkxA)oEJ%7zQ`ImMR{DW?k~MwLUJgtsQFHHE-_YV!ri0yI4!LGY)afKm35|AFkZtue1!7alHnHD%=*hXiEq2D>plKWrI( z)~z2+nkr&L4e|C|Yh~c`-~x`FQ{g=KGjSjvF%1jvpffaS8l3Zqp7OeBVrk%f&|t-3 znqj^Y^aw}vRWKc@f1-{KPKT5ue`Pu*Xsf4f%u_IDD4&nidd5>;_mr68$2i%UH0d6b zg~@&)iVCtsxb;r6j_J%2IhNV|?nWH(yIaWrDbd3((X53$>hATQM0Ttjn~?_E-DwZ( zecaFfI122FkDIxy7YqWA=(RfX%f=~_n_~vIgY4e0ZruNAnY$hLX^b)otBeHqdKKZ& zUHP?n6f#pur1!E#qLn-E-IB?BoEzEL<3MkQJk76|>S+4Y!e(=e2U}Ja38Acxq+4Ho;GL90gl`ZD*~P5jri`xy~xjR)Ls{4EOd&CiJF zn0Zl;fl#)9y$fBggLZ5z^+53JppWmeWOzk6UncdS*7`Dh30#J@S^C|B3Zi$+<5b_rAoIQe2M!`V2FY8Sm`7K4unphgDJ0 zpT&N^7roF;si!Hku$nEer9Z7+BWB6+v$Qk^Rx9Z&?Kacq9PBPr(kbReks191 z=;L@*<9>6PR(|mXM``PdT@%DArOJcM|Imf5PVl#hNLiI0+?$NW)0WGv8&@{*_jaxb(64NY4#HD_`#ysYC zszn(TF-L@k;(RLZcfgjiAQS>8an*~Wa9K)zZ#%zh1tr;Y(DSHsv~dn57wyi?5s|i; zX!B3-Xm7$tbTCVg=(7<=D&+MSE`>(9|`PS;{2c@T;N=V)P`7!k1#c)~I=gr*G9 z1+d9ARR0n|FJG1+^mHnxbURNZ+vIr;yjZ=ZGonw!LKJ*I%$uHGgsa^+k0xXbge~;eBc!zC9TWnbOJsQ3WuY-EH|> zT8=2}sr&`=EA78FFRA4Vp+m4*hbSHGyIj5X&-`u5V|}dy;k+noi*~uDqReuSO|kse znq*PJ5_*fU?q}^-(L?-Qigu67wGSP?ZNKVz65YhHi{Hwt4HTa*g2?ApF~IM#j)f!X z9c7mrXvC|KGXRvl3M2JV1AX`^)~dTNkZ(TZ*l0LC{DBLG?P1DV%==Wh{Ybssz%}v$ z9m>asFZBWiEC9|=FVK_)B07Mn;f7> z7Kn%u+YwO>7aglZVib<>^*LUHe)u2)`xN`9dY``pr+)g`fT5KI&@a&M`&ThPAc$YJ zhJ?UNb4U*4+uuMd{|e(AevvBv3K}rpW=?xtq@Y4ER}Q*JYYIh7#D1nd-+_G{OcC~Y zdY(PVfsp@%48;drW|KAH0?F6JxPKeI^97pwni!eqC{?bSUGUFu8t8Bp4wu3D`QTL7 zg5avorV4PVfl!7<@zDLTcy~gaj$5?dF={A>+8aT#I&KKW9ZE<5tF3__LxBVQ5&EE( z*F<-@`65{t!m2xA92R2Iw_T)?g_t;ZYh#m|AxB-Hx`iUs@&z*!SeH~U>PqRai*y;> zNIPE_F#(Z{EGCY15<;sgFK>u!Bw2)=+Z~Mrsm_T`Ks~=Tk|sU4R~~PoC8o05=I2o7 zqXcfYppK^y(;xm^BPA~uBWV00k;F*WEP|1Ey^(B-g)Q(iy+OBsYVeufV1_)>NEM55 zc$ugF@|+@D8|gOM$SAa3B9eVA*g=#Yb536(LIuY)EG&jso_UGZ7i0W?xI}fu5QZg} z$nOoj6dZbq4!!{aU3raPd=F%2cG$d_q-34&nuT&9@iB01u2bKF1bv|u^Gg%$XI ze={$JT=on;;lx@VclQ=J{4fFyg@GZP&$+=?i6FB1Ef}%SycW;R+jBD{qZ2c~y9;Oj- zb2@Kim#Yll&0ebWO40Kia*5kyq6RCOQC-aM$+=A@!1mfO4)f=LwrTbU^(g$(ExwB3 z9PqoM8|KY3Zcj7}TiKPD(H9O!LJ@p3bd?yyM9p1=qjk5ybh%2$S3!{Qg61|-OQcQ| z+^6z}t~NK&y?UXvySY^TA*GeV*_qftxuxKak=m%X6p?JmTrUNykjAfuD1se}SHpim z{?KZO^1OSw0T8I5`5*qJ%(S+vg?Ld zWd&=o#|vySrjFs@HxFQuHtSYiXP9<){`r;}Dt`j2y*ze#_yeM-DK!5f+II8el z)~thrTF^wHZ^MKk&3RkI1Tj9TggV@JXtMl6_n>eyKECSnW5xL!oJhyCfF z;-yymcjJpuDxhn|LV!gCCzC(uA%dDo*OFD$J^kxUmF6;5M?K!Kc0DeSrgTKp&Eax%{$~t2YZov}183XNIGz9k~hsm3H z{1awA_D$b9Z@(|n^g*O;!}@tw3sr2xAZE5u^EN(6YazewSRI~dq44cS`MB*kSex0x zL*KYTF4dkG)P~KE|#k5iw#PL$H9y_Y(*f(%4VH z9;9iXfC8kOKM}J67{9&fVO&9K2uap8iun|q)MW^0{1g*8uRqlxA8-tCFZBmlO! zxv)Qtt`I???(%TUJMhQVxG=<$!9|HH?Ejd(xIgY&f&)<@0)3438xk(?L>N4u~Tp7@WwkEcEgP~eFxVowCW5dai`>IqLyleuJ`?z+89yS zPs#QL(t*1umeYjYl%}VDryQi(*!>1kZ$8 z_NAoLXGM^2wWm<4)-%C0*;m@+VGl*>2Cs}PKTK_hfV}z$H#LzDJnEHMp=ZFcVbbQS zKMNXM1MVHuIi<}$&cF%{{v4E~pENtVAo^%iPkL(P{*x42E#kFhr@U}KUgLq#^1U+Z zh8i!5%WI7BiPQS*s|lw)mD>2zj6+Z!^XifbVXyT-$iB6-^Dw$js`d0HD{IO26$ZZS zjHgiDamLe3t@O&s{b#7;E8wX8+5;{f_0$F&vZ#iBi%UzNYh86MEpAF%* zbiVD4bE?bJMi#krkyfjqdM{Rqo@%jB>DMRmP%U-KtE;p+OjYUr&qYsdp2`PMrs$WU z^y5=dLcP$ik=kq@h7h#tB&N_ur5_ksl;%OE#c2#-g745X8twWV;1;77OFkkM0bw$s zM<-98+IT%jJ*=iwU zE4orFQnl=N22jyah;l6DpiCQhzlU7yaj%Tr5l1!L>Q=Icoof0>Pe!X8$!!hx$f!}2 zb_SjGeS&h3TKZ&jr72r#(z7Pf_8Ff3WWo$8ISVa$5%iuw+c_TOGGq>=)q%kMbGU(N zXLEIV36gN`c?Dpd#4~+-7#qzN2id+BxoY9d?N~a>x#;#dgl4XRgpHV5_DVZ|MQ!rV z^qA+V(F*5zC{;Ij)u`oWM(^IMLWcZ>+AtpNFM4l|rFEjarD492(d~ko^(qL$g5Zm* zk(hNncfJewSs1H+{Q_zO`_!(lVWby5qn$QRvSG$c zfaMIT>$XiSr?zWil6F!r(>2g0R~W#lkur{|u8S&lfLWqbU)KuitG*LiTIC8xlt;V1 zfL^~vX{~Tl2dr|Iw2C?*Z>^%78yG-HsgBK=dS3Vmo7ZKJWNpKM0LX^b1YIO$vvB#ZBl|w zt($aV)y8f%`V4LqgK1?KEOBKWWTBk5nPPoqkXl);o4lUdu&rLS?cYizzH*X!bE|=x z7ecX(Y?_>;jos!2IC~qb#w4vlFNCiO=4$p27@`Xet_G)DJ}^+|D$@DGc6@!*VMfN; zV!@K4W|>vGZSa8kvGhkevpUO^Zt~`bw6mAYl_5Kwv7vHh2Q_YIJHCFpE<5A<$ea#Z z(oUuzk6bm7(S`~GDD__1gE~jbDlKD|S9R8IF9HYt&B(A1B+ch?DI+PjpUhE<_F|>{ zUf7|;mHlLQS&nbiqGW|yeL$a+hny+*$i6~tI^e;mg&Z{4#loXz9Q4%4tk0b_(K24D zWuJRW)uUB<#tCYtN_D^&MiuAOGEZiqK9$a|>4yxU@;hV?XJIU6SKV(G=}G{e zgi!9iGJ{yfoK=HlXQ8HiX*2>v4`=7WT(qOwt0)CO5bPso9;TdOa-~*um`5>~^4R4& zqJufhhqEg%@SMnS?nshRLUxU&D-X(`jw|{LWkr8Q89={CmciC)+`d+gqlvf>icOY5 zk^U2LI5$yIQl1yUY5db)d*N{~{;&sCRBQ&*kE-~i`N=ZWHv>D#jH9%fpUbgREJs`~ zKUd;;$1%E{EW>?v923ftgy60eH&XihaxTF^V@AqQdGisPHByFm2pK1p7ndXk-}zr> C0+I#* delta 45136 zcmb@v4_uU0_6K~QJHs%HNQgMnWaBUn10fL-8Eb?C5)mQ($;?=_(a6Yk&CHBk*O^>1 z)(FUJKK#rK6wP%>@V}WFnkku?nwhy~ROY(nnze4ZuEqO3_jw)|somfEdp|FIrt>`K z-h1x3=bm%!x#!*)FRqK&s7BPp*;ol@8H};9cfH`w4P3gPG5VN+VNAh)_$#3gm!GY_ zRTzE32(Op7>{D3FKC}FcL4(o*3bW|t;ecCFzIC5Teh5vpjnD8eXOw0QU@U8ZLLUo@ zj9@JCg}=ST*-3!(Wu5FmYpe9KShrLr(b3<_#yhr7IgA?yi`{6FppFSC0z| zd;V%ebI+H|8(xXKMcEMV=x^C@x9eB7ysTo4jie-ndGH|^`l;yh9{UMr7x5W|Pb)r2 z_=u-(>M8z`+&$1d%)(kRN`I@F?TIz97Y{Yyg-N4h#1I2<<-e1R)Nn_d}iab+Gb)K0bB4XNI{1;q8>i8 z@i~fjSE`9k!>1YVdjOLFYXG;R>>@r{c&<%}G%-I4N`W|cC8)b%QZQ_^iff zD?Y7Z_+QK54WnXB76jlIey+dI$ z04wqpR!8rJ3OfLJp;%#;0GHkmOYFv2%2 zfMfg$I|sNL&>9KXFaZPrn*n`*01lr9$3Ud~0UQHn%!e~0_#7Gn7E~%MG71ErS6BvMOBFZ=j9iFzfU^NB z0R2K?8zGScfUEHyy+~nu0LuZ}05e{M!~o5UA?a(-9xx+-hgdum0A|!GtPF4|U6~JkLt;--$z;l4B0V7|*zyMjfy;1$55fGvN5(g0Sh z1)-i`1TYiu0N`-I3xK77u}vTdm;qP`SPIwxSOK^lFm0W}P6ArjgE7D$U~DWHSRa7) z;^7bwS%7&P6u4S61S|(^2CM}Wg)IV{vIBGg%ihEQ0c!$yIERP07KNGZU|<(U3Rt%r1OQtBO99P$pc8-x z02=|Vd%+0cY`~L%+W{{Do(7EWjr#jAFu-QOJU~yY!u)_``#}eA2H;Y_zy&;P#Y6C2 zg&hZM0lWw}>L3WkfkVI~!1DK@q<}{O%K%djDJ%#$7O)mD2-pl*0k{XS74RhBxx)}S zVDu4){94ri08W~Sp{+n%0;~j__aSrv@Fd`NK;JPC0zCQ=yp#hYybKWo zuKp4B4>;{7j0|uoU^(E0c1#&yMigh;0T%%t0=xux8n7&yGxK%OktEL2u7myi2XHnP zh+qb1^8m-*!dV?)Ip9{n1KDT@nC0W_3g8&P=sqyd91s9J4mb*M_7Kjd0b27w2QUe6 zDc~W%jev{pKuiJH4A=&EAs>tcu7?uc$ypqrA20>*5TFn69N-whi-1!AV+%M70+s?U z0$c>x2$)oe5dt;?UIeVU8w@%Di@+eDXDDYyfMbSpRt~rwum2+jhHc!(Xz*&e`5 zz~g{5qc}SUcoLBHg>v4@Ssy?@U?$*Fz)^s$fYShzMq|W)d4RQmjeuJLF9IF~blu0< z1;A!Nvx~8_fN_A$_wxYD!$UM;OFv-juQ{s#3<53%WMeUh^bU9u@EqVJz)|Bki;TzI z19|{20pj2qOgC19%AV65v@t|HBwzKRA{$&;zWS4ABGb0W1Z~oWfZp zU=Xl@$^%nD01vT`LgauRK(hy&0`>u{1*C$PzGxPe9~=F2EGP8Gr?Vfm%HH@nD|G*=)ePC&3wDbUAbaFa_{9U@71^ zz)C>oh4uo*0>(XsC>hW<8w>)D1uO+D11twLKMiXF3<7Qhtel6b1RV1Wbixb!---uw zB9!4-a0qw^Fb(j+bI^Xk$Vw;~pbu~!U=VOAVCD0eQ@{g&t$-J+Kp1dTH3$W~ z#90=Ul8udu%X>v(Xv=2cGiH(~yxlRV2E`3joEJ5w=oRG!UW51%uZ{RD-2)TW%3MYn zx?-*PWIQaE-JZ;YzY+TZPEHly-|pn|9uxNLD+iyr@hOpWV9~qgIFy*q$fF z)a+!Q_dBr!ASEdFW+!()z5teu`C+9|XH&(5QP)}EB3Rk;!a3N%k5-96gWdc>wHS}L z;Wc8`U?-1$K`a4S^n%zn*m1{c$fgv{(On0dG=x4Tgh7y(KD@YsR}|R|F@va@okLkG z)>X7?SuPG|_ZDeB>-deUfCZ9qkQ@GrvXH-Esxd=%ftrU_vtNbkQMoQp7ao@ae-ilN z+Mtg|jD1CUkuNd{^TMzfEH&X&rv-IV{v?+8oR-sgJoIO=)8~w^g7WOwU|!>;a38| zP<91nMOu$rZC%ES$c#-vor1Su0eGfAtQ#x{+}5|mtXxM)9UiT3!}(EJmr2`>vLcj~ z{X*Gslx;-W_AX^EykA7ww7uedt}`{x0%`4oOsE?Eh@%wX3PNzikq@}x`^2Cj4vQa; z)7}v!LmUx7JRW}s8YRXJ=^asrx2*k`S@HC}y}d1XtHc`_2N>_rC>LH&qAc@WERswt z^V!9PA?89B4o`Cc>#!zqX@0~^9Pn4(gAd0u{n50i0B1d@s}@Mpw7Y=M1HSB_$j);{ zl;JV+eU4ClTv6{wD)44Lgp~x9h!<)=gzA7#0^SvZr%ty5UjV!z6|#^6zzqkkRI7WH z^_)f7MwF$9`g?m0G^1G?-l!G*5sU-w5^yzy$csud?2F1WP*!nRq~2jK9FE65hdVna zCQE@k031z2DD$&{KMQ<$2%hRJ0^WZ_RNdjo--yS|4}Lzr1Hg{~9zg!lnA@mX2##cR z5xBAs#Q8hi&OX@p%>J;`K^X2a19;alk(zI}498>TF;STBm^clO&BuQ(@Cx9M{sO)Z z_)A^zaw355^RYg5FyzAL0C1Tfi@o_y%LP1MIU&Bv_Xhf4=eg(8&LNTH(ttYvTo#@o zxg_G5sLEYzo6a5H2{#sXQ@Y@$0XG~t7s~06XwCy}8gOZZ=v1Y?Y$*!r3<7!qO~*#y z_q2(%cRDOb@i^skaqvz@{zW|IeW6btA0<_i*oeeFcsuZh?hwvJdu8A<@l1b2H3PWF z(;~INVHt(T;Av4@U=K{g(-1<)J$N35D*x--rS=Uom9?dr?^ zCbIFEhsQo&i}824BWQ0Q_jd#z(u>dz-+Ug5Cf^$Iwi<6&M9y73#}Q8lfN8jJb>D

Tfj3`- zIw|m4j_@E}egEX*rNZmO8}MxXo{KjNdtFbNg}fgSo}vl;(NrDRvU4bty`ju-EM&f8Q0D&^)(&mjS1YBj zC@Nnp{&07X>w+k2_;;sYrG6Fx*ZglTn(pou-i+szD_p#L_qF#Q!t?ek;2w3b%yzhP zYI6={S5US{>m$=x{^WR&%BX4Yus`W`Nh2sXasc?VG{qJl-ZnB(QsfBu@ffX`*cj@F z`=nJ6p>p8MfKMZQr_r$*;A?>o_3Na|lvCLbyrG6fV>@trfb-$mph3(W1>Vd-Lt)|{ zMZKIC@t$Prpy?u~;X=Jg5H2za?@(t+8XjxSNC5&3QXNY^$%E1}Nnyw-YGqf+stjc< zDAVWasI4Bxd&*M?7pq`7|Uj{dlH7!nFc-2spWl;+^<9 z30#H`3F=?4Q0j*gO$|9n-6Cm$e$JXP%Il(&kTt5iA6S~?yePjGJd-AjLdnvJV(Kt= z#B4lne+W5IvO8xj-fAbAu3AZ{gJ$42P7?cvdG9@mN9(i>UOK{%i@=vZrZ+_s;@gUN zcoA@`@eB@HLgPsnP)R7ynvQJ0_%^q9Kq?0?v5%Wr1C4Y{l(pamEy^azl%Z_v3=^xw zGyRdy&IT^;38e1{5u*2tfG_QWCmM~wN6y5oQ+@mqjTYbz%|s@hST=~b@OT^r=TO3ux#7SKml%y`C2)1Xr4deF(p`9L0RGTZV&@2FA!YAMe~0rC ztx9IsanVGaL!EP|)27ww@ThWHk*qr~8xgxA=H%MlN%Z=A6I-NLH5@D{P9DnqbHwd{J zr!V12ggXt~foDvth%q=V{L#=Z0U0-6{4~-Yh()?^)O?%>Q5n?7V4bR^p=>G2^uD7* z%P1{*9A(lGwzhBEWBR~z+g;7Wm$8iqOqYwXzh2Z1cZ3w0jiY$Tt}Xml3k zI&)VsZ~$d#6~D~DS(J@MSq;&}A2D?WxO2c|N({7%@V(8@%Rh?IqrC1cc#d-mbf)v7 zqK!q01Uv?1MbC+4quh=l9*0+&w0%5^XdH`x+g>S7jB;2u;xX%aae0)Z_$XnY*K1;M z20>!x0?LxA^nv4@X4(vq*8nFag!-f%^xOyd#ws!AUWX+Mj~Ufs*}e7wWAHe(8b^hw zL4QPb3Q+*ga1X?K5V$_bL1c;Uqpw>y+H6@3#F!U^ZM1vhA*#PnclIGM195YXs)>#z z&Pv=+A7&(BX9Ir}&-6#QIN*ja(()XHBd$|`D_bP0MmqvUcsz~blT?O3BJT&T<;AN9 ziym1y@F#&EOBF-ZipmzDEORkDqgK{2LqxBc+M$ewOqxXO62A3Xb}M75E~hbC0TF9M zgACxyG@I)nMrBt}wzO7^zt3)oL$3Jf|A<-ld7XK9Jo(bqT~K#pfoDs_&imZXd3c=h zvaYX1QBr86XG?+K{<8S#K5s-TQF#UHyNvQE6+OHTi!&;PvV8@3Kk#W9UJ|0=#3J)t z1AJZ=dzfh(054Ht>be9D^6 zdM=c?fEz_PtS1;zT1Wy&H2K0P^^ui_IqXSB-6coy*t!X)(0VbA;Vf{AHec<^uK;%uxJzU@ z_@f!5lZJC!JE9QDAMug|eB|q5!LQwc;do5h@$(^+0bc-o2GPPFk(&+NY~Xx^fHO9{ z&m!Qr10NaE^=jZ+cmBL?3-H!AAy%z!K+efgAk$i|9?x0eYJe-J&hSU$zCw+6;iO$+ zG+Z@~k*Z9i zbm6fa_;Y*2iLuUzrFh)47Z)%@eM(OeJnt)M$;Zv?aqqv|XJB2# zMhZ=pjVyA^B#(!)_~dZrBDV1tR)yO?Sq=Y#6nv7W@CfD%S9Ch2ZN$@G(kfeJk&*pBsWNmfdJ{d?EN}JLv@Y%8-K3 zIt%#55d5E%&JKPI!FLboIGT4dv?`?Iln{KDDvDlO`3cVF-874J#YQFe2@Ck4-$Y;z)2pCLZ+_YIr|LkVeZoES;KAoGZsG#^~OQq@;i zkcWUHh7$DIHM4MUf~&=p!B$mIYC)Mf481f|OIk@Srl*YhnLgOS`le{MvkCQiicz13 zc~)$qLAL~WFP&&o2Z1)eMb(xAlKzylEYi%vJl*wr9@HZ#5<^Bk*Dv6xOktb6eL~9U z-H>v!^=bY_d$=psY>xK+N+=V1^7sBn*e5z;?)gfakAw;zBe6XCg~*@iO(iv$1(gfa z8KEL#4ikmx8HxPAJ~eX_JUzCFB@@#FZ%9E{JcfqcqWGjGzV;`rhg)^+)Obp$%;f75 zCoH8h7r$FCvoT*BX;(t650m85wUO~#bvD}DANT&N-Ea4s2Y6{($$|;`x+iq=+^`+Q z(ip!`D@H$F;eeH+DoCcAi_)C zj+3v^m?Js{)wV>N3>0UV+Iwty$#~VQB3V3C+Berw6B>abv~$cy9#Y!HusHJCfk#Vy(e|{lEd%Rintf%v@VfI8{OQqPFNoD+UYeRlW}cEAwS6R zx9ddiLj(DOFT|{eoCCEQEu8vFaMkhOuG6G{zFp%jSAQSOS`f}_yppIMvImHl6FM)3 zi5nA1lbFdH5@AVb6a#mw;1eH%NX=tq=BgK7rt+1Eq!tXcX3i|OY=36*_#i0tb_WG`h7#z`e;-iJHI{z;1i$rr5+QeF|AR#)l;p<2$_UY9%0Yq2n{g{9;d!hwuqW+As{2d#l$~ zc=74O34v~PKc{&EizHRu~gGB!3L#74Abuj^cGUM~9$FhkDN zVN6KJ_W#iF&TgH|_5Kfa3`U;nZZP7L^GO1we*V=#WB7j`;jOyn(5OjcN+Udt1o!N7 zS6bmh2!FPHM`A2{v#Fm8Cn;OS$Va^PvIu3NS$Fd^_hk`gZ&`$>dL%V|Dde`+;*tJN zVWuoxgQ-alf6%k>f8ZXXC$MDk$s@PLwDeApjNTsZ#bW8=H*6QllM8MB2v;NVui0&P zvXw8X9o$N?sGr=k!y!7|a$EYE8YCuV*PX09~|)Y6*bV}u_E zys`Qv1cN-GuEmsa!NnCe!lQXCdd~MGB)ND(1(i`9#$n^t)8!iF=UTsUJ+tV+0tU(? zBR#XiSkJ754Pw<4w^tL6kA#DWG0c;YRwo^0LMGvYSe92-mwYA8PqCMjfNVI%6>YGK z;y78%BCWu`0O|_MO~I;OZ8%lQBI-$&5OPu-#yGTsd;Ad-5JL6?6ytyEEPf8;&1MS} zrHyw^EO~rws;GK2i%)v8-6dCs>uKWQ;j{^luS{YZzEiWL7v72Ii)vRD~;*YwW$74rGuHHjTLA@*i*K%NCiJ&fWANAT~Cz*A$ zW=(%|vle|P1-YYRc6@p`P}dPgLAi8X3lv2YYbUOacl#Nx#bnWOd6?;&pqNx23xu>D zZ9!!GFYUf?IVa*Jv38oh(2#2;!mA|2by@7yj#!Xz8K8Cd8qH(d^~EL&_z6uKj*P&A zcJDTcsK=7Ma-?t{K2~3?uy_w(lhJik$674LKW2AR)%|@uo)s@?dZsPW45p$jS)-g{ z@neJRhG+e^P4lef_Em{1UJ_>>)8n6tAbVCHqm;S~Fr=e;4}>*Gl{39J6iAdzcjz95 z!C*Q=(&_rR3Zfbk)1YrOURud!=y)1yK@6e*j1{ppdl&CeYW6nI_XGrnAg{(EMJ7>zO zYPQr1D(}BqVL|v|Uzc*DZNq8uMJ=Wo;VYV^g)eVnY?tVdxkh=wS{`2Cbby@rRSXh; zTE_>JQg7FejWUC$&eqs;slyJ-)$750lUxthKIP!B zx&2SM`QNS==bv&WOIHo^g-e&yMQgc%gG<+Ob-;;%vy!Rt#98jX8{j(0QfagQr7kNn z9g6m6I6dm4wMt*Hdsd;os!5L+vCQy@1Af=jHc4Mnv5po0&hEXr=hb}YS+sTRBe{;z z4EnIG5(|E}L|?!{7pveeELH|Cbg?pUzqD8dyDU~N-losf8t_d5?}J@Yg4Hip%O`>C)B)QMfP=xoDt zlK#w4-$+|E;@PF+S4C!fAZpPqcs(}oB01=wxyuhaN7JAZAn8)X6Jsz@JrE{hmf7d} zg!q9se7KKUJi|lYnPP!2>MW;sqSM|awgsL1wLggyL5EBnFy&RRYze0@N_s$Hds+(w z$WIi65DB6aB0}D~Pe*{`;^et01yf{NALu%q?N*BSSbmi4Z?iHCzk`jU%yT~JNL%Gf7&UZ1kJ8X{|8oWX>YrBRU(yl zUHZ%Q(BMCnH}=%qgCCto6F>Qi82E>5Eio1hvQKo2C*DJLut{}>8+`2#y`v`SZjdHt z%2{#b5AGNP<%*_{`ozK+k-R{6?@PwQA6z)eyer-dvbttFhtTNiUtCsLnr^7FVi{fxI`NDAwTH9klqo&QWS zANGY<|BQRGWEk0E>R?tFrOS;a$WLxlE^1KMG++|*sNc0*0I+?sq$@(V@f^xjl z5aAUKPLsvU&-P9wiIQY}NgE)^AXHM5`mc0(F=Zsep2v~T_mQ4{{;ZpJJeCTlRK_B- z)H3xx-dAst>1{|fQn=WO$~h)n33|$Ou1p-KFD){a2>c_Etig1etwVBH)Ovc7Ll(6z zgS!nCl&qaGhIF)b>M^WSnNBDLwpntm(v|N9Y@TWAH6;?KD)RZ9dg1+}lSY&ON2goL z!P+^R`*gD+E`3Q2iN(vs{6ChYzo|2u!g6jfoM{-#!_70scI#!Ste_XYGnV|qntBnl zU?Be(0qp`eKUpuPE^zXF^`dG)axarUTjP-Y{UghfZA{|51^v1(<3e`F$A}TlU&g0` znV9D^cao49l-8v!-Xi}wr>z7jHT?p!Hp){M z5=m#urwz`fg^cImb9TGoyW88Nyd|TBKLnBIJ{4{iOpN?v`6_!{VN^8#?9ZM3`o>OM|QG-=(_&U(za4lZDT_3k_0F zKt1WS%&@&sU8mvq!H!%TUr&#P1*ONqjH1J*Yo3AE*|}W&^n79NB=Y+(;d|to>Eazb zNIg39L+gD#*LSR+B;6xn@el{kqJ!b%v0_1$+#al|8cD(Sbq>X8~r1;F7la!)IR)mM*U#>})zAYis#b1y-X%4kK z3{9EgLNFo72-3R|SsT8NaO8gIaF5PF`dG0ou&%52Sl_I+vNltab%#_RI(NuKPGbrB zFoGDut+RS=mPjLViNJC~1w@o88~8cc0T3S3mAGVuIQ4>;4|rWz7P{@4o-l44$ddoS ztYanr0+qeb!9db7pbqVCPh!YD3>6<=z4A`xqQ@o^b-$Fjr z0@Gh8vI#5@?vbge#pIuBIhBSX7XLfKW5&{#yHQ5_;b=(Az#E&Xzy>X5XDp|(2eiU# zr94%9N_KGrki6GUya60rG{{NwLzyarGVyvG zncf7KjLTAA9Br$Wj6{235>+ow4YaJ?k(f2&&8Ex|JDV~_Y-vgxvAHQ_#HOaC5gVI4 zBQ`X-Myzk@Gh$s++=yo69G#)3TKQN>NpF&Vdtv{SmZmUIstv(Vy8M=Z(VkICZ}QcVb^CRwap z+;>oUUZ*}AwT+Z5)zVr%=%GUyV?VbPY+*V7X|aPsOo!?SP_l~-T2f7VQn*H2QCIVu zJq6ZHiGKU$M2>wX@j_u4Eg3)1eju}j_chU7U52o&1wjIE*dzQ?S17}C(k%w!w7($? zJk!*0OpRCZ-6je6*cQ3}Bl}Ook#do>uBiYY#(IN^Rf(@gn?18|MTK^6e)~GuQBF#M zRh(D7{pbD}{UUKk(>o1vEB9?kEYI7N*aJL2$n2gRQs@h9IIh?t2G{n|O&swtJiz;0 zpFp@PLlJSVE+;iq5%=*l$>!PiW4#sjQKEOXrrdP?P!^#rO??q*l>63ohO3w>;^_?V zBu9$7;duf`Vega~aR|^v6-fAFc7jP%*rH!Ep<^Pyy&0Fu#36 z;*F4x-@Y7oGDl0M|H<#uC&bS~+Vbx)DYTgH$E928gm04_`uL}~aX>RjjP%25qV4lF z#y&D*L?+ATugjZQ;Z1@x4H8rCO@+gx=%%wXBscf0V%+(6lXJ}nh96qEYaYHq` zA)6uF$zrQuW9FQcxS?b?0nKpgq>@g+m8SBn%`luTiKRGV9><*chDfY59-3lGl*O^- zxM{Yj34_2Gw3}yS_*xw4hZDxsXSPYhy1QehD5lix*0`ucGgi{V0??Bde)G?)Ef*K8 z$4m7X#74;}Q;;|P882-g=gTu!r-rOgh7 zaGG?;Ff^CJZkOSAX8~MbH7yX?x|>U9nst$7(bWTr=b-qQ42$QXHt~7AJ1~lj4bt4G z3ngK-pGD&?;Fb1C-u~7PSiE%tYj00Pb*)}3^Go}RyK7~lS-Nx=e;Z|V!rfhd?E=?q z@7i3w72TQHF6k&X;@QG>N#Xa8p2-ueKGx0Ji`~Lq@{2^wU}B21UexN-PAU>AEKGx5A4;#$fDT84&-D)U-(IVZEmN~(BnDqzSmzN9dH zG%P&;!Z|gz=+8JMPNLan=x2*5O(#S|LkZzDLRz&&PkYlwLSJq8o%)FA4xfSRI{Fv& z(HnM>hxvyeLT(A(pNxVsJ`5Qja^eYfn#unz9Q!cL9o=7`dkQ^tKT8Ic$<|fJvZtk% zlk0e0c~L&UujeVqk{^O6pec|{rTO{qbVjLc>+K!uC6ZMjW)!{~Lf}?xT(uGTuUc!h z?4i7+Pyw2q+m#K{Flf6{p3xcJQLvJzxTF9nprKiahCe1g?n6GTJPqC^13!iVr!qC%C_y=@^0a2TTPNbg5LO7d1IC}zJED;)aNy->tMu)zpOcTJdgU1_6MxVX44Qu> zJy){oEdx9SX3h1GmOKy=Dw-j+f&eqph}433 z4$zUVG-kFB3revXelD~#jTV!%=AzTMyVfD1+5lUj{d~xL5y!>YOBGm~WynR6pgfy4 zpKV;rw=sU7E|Ey4&1HF7y=Z6gX;$5$LnTQx&&L`ns4+n?_He}5Sg`_d3IBb~jK*~X zS_-u_Q(H2PD2a$~f_`^hDvijW%J*TTOKoKxMCrydNz>Hc9^i=4+>N0GZ|~UjwwNf0 zq>E@HFfy`GQdYW%MnuXY*mCNC2+u_)M&11XrS6;7&bqe+{+G%DFk=u-`(Nt*wnt~( zg#S?2j~hRl(`KB)ArV)f85pRGn1aWy(TLHxxeGxWeL{2{$4;~wJJM?GOsla&t;SBZ z8avi%>|Cp{gRRC+wi-KHnSbz&(DDy=#TZkDT{(*mND-fF|L-D3a-u^LpZ%A*ojD8a zsPyUk@ITboVzmHV8T)y#R$&Bdux*17Nr7q`dO%Xx+1_F&-5?KW_yW=oszZDP#a7fCU>JA1CcYM_qPL7kk-Nz*=QMU8u1J%mlMkenIoB^v4m{>Q47T*S(uk0 zL7|1i1F(RuulC_GSiE&Px{j}zqBDzYah}WVLnQ6T|I``1-ijNX@H#?r&40(&oYF^flP{Ye?bojg z-W(!wBRl)&j!U)JCFlO6xzSi%X%gam%*Q6A_+&tZ%n3G|S~N$&)NsxaM8yqVDXw94 zQq&3?BKkGmGBR#xL!uGYd4BZiWlB~)oRbSN5e*RS{;M(@lBd|G;H=o(FFA;R5{9|K3$WFNY%^|WEsaheP=_|U5YDE z*j⃸Z}e5{>KOFJqJgV9|HS^0x@#fvNH_-z1}e2-#1G?z128X@*JI|F4AIW^(B9ni#mL3YBa6}k!lc=e(<yM)((cM11EO&8uW!P-Z;i_gGTk z{5-kWK;=k%2}v^~YTDi6#QLaw+SbHH(Iu_WOV+rgjiJ$T3Wd*MtXEc9_x0ZPc1s2k zp;T&}%==*ngDn!ygHku7^I2=e#0}nCfCD#-EXDx1Dq}=I=ML-vgZ#2 z%P4jipKnU$V|I$D%?`Vf#WPa#acl!Z0g=6VJRQg^+wAaaPR0c%(?dELBNm`!6&o~U zb^u0q-=D>)&Bb~)-cE-d({(P4Z@u6SSjiTLbyABKvx}PVp zGGzr^4`=+?Zps?=c3B3$mNV`v+puNpjS7BvJIZ5X*I+z#P2$|^-aB*CTJWvMe$iv_ zOPeN^TN=sYqbIW9wc#w78P58}eZk`6{=jf2r74N6X!5YerpsYNZj6t1E3`f7Hth=~ zKKeZ+PCT;hx=i8;l4luAGsH}$ABcpzYjBEMmxzl)3UecGy}J$`sD>O1XS?b|${S<6 z)VK~RNV_@hGMn~o!}j(V4_$#kNKNuw^F}fEHHyn`q&tfnDO{Zgl6fAjgOIQp8{|7I>90u^p?#*7E{_mI#meRUZBn#gXM-hHjCJkOJC zozKF=u3bIFp_Yso1M9UWn()K7DQjO7_Fd_`;WbeRfVVlj95GXL4o&P2@=H#8UlVI~ z4KyDBT5R3bXCbBuO1^yeAOfd$JCLammv=j^uS|-sq%R+4TDEkgYm6IS$zs4;eI22B zm%+N5qtpnlSxtV+Nf!1pnt00EHU#*-cKM|MLNSy zrv11nMP(%Y%&1qv@XzZUjndB2Gow}|8eNgBpc zSaD!~8ZY}w{IuVpPmC*cVv^r=^L^Vy@w>^kgl3wI$LTzF?z`h1#tJwTX!7$0#ME7W zH=P5d9`HJb$!YTQzv<$lIiH7(8?HA`Jy4QQtkbz^rz(*2{k+u(?Vt-5G@*EeVi1aR z+6P-YW1TvwD^c%xDP$P<-v6h_#ppnfTsFVwCSoVv^Trt=%N)s$Hb$uUa6czfes2`K58{#;Nu z%{!1FIxqdXC=sE>ykCj+2jwlVV+TiiTlRUSJys?SkZ^^5y^=%}P3{%&(_NzY{q!i> zm{Lb{QZeqYqU!xr9Ab!_@7wJ^{1s}0lS8v^BUUz|@!@sitM`xDXg}Al!o;3mC-xum z^0v>!cK~HWh2yZBj;6B@r}KUIdeh-aZi-fGp>R@&L(>}>%c=SaF2M}5CES={;_~6b z(KW-|jjM5q);I#EBEFtki-4!+nqjWS23B8f3#LgA@;BT;w&0@7m|?j%lU;$^FGCus zjOvaWmWDPwYxpp+3SHk&06$fu?Kgj2Y)`{;wm>P8y0i+pw8xy+7+ApRb9nHtC7yFMoCef}3kweE< zG086`1cT^vUSrWI7CCL&Jdaa95rQ=3gb||(g2FMw+=!PHY(kW^gqt$d<5?QbJv1qA zT|++&Yl582B&Wg;y-`KOCg3*|m9;nlTDyO}nDb#iak=-yi4KZD<6RRtVzEa%`Y8Z3DCR^VdU8^e+W4oCfTdSJcR+7>*4Vze zaF+3l9^WW7A5R~cRh;H|`y|PlaSOf*=_`J)%BcrT78aY8S3I|>y*&>BurDsJc;4C| zepJ|3ESw+P^HM+2nkBUQc*G@_i7db%Wi-!qfS>i0;8jH@^vXmY4}b-4o~!i&MYUhP0#&`2u*L3U~#&tGS48XrfyjLr#g*&+LOYcIRes>a#(CvZ1@-Vkm!EkINPoPcclFEPYL!9}1AVp)&FWlY8;Rn$pV_dU({}*N?JH@0g zrt|Agi4$KqspjP`1_lzb22s|8jBwGgn{^-R$04JS&uOE>)vzq9?vF?ziohyK=(g>BH+28AAPX<<-Pe)Q`y_xinPEBzKKZ8U@j~M*a&Q>>5^%!Z--h z49$4EP3%1Fa2r>CR!JE#oW;j5dZvEjcwN&d-03{+jUv`bB(c1q8iPvxaxx8S$(PQK zz=d)#Nn6FDnkCM7BPf{WlIgJ#nmVZh25_eDG~aMWb>+5=_asji(%LEsuRQuXM5X<*eo4xUMVf!YP-}d^3LEp?# zNJiT(Z03hw7t_B@=J&oXmVNu3w)#0l$~TccZj4~ZoaWGFe4YO52tVx*vo2=atvgBou}b0hSH>Z9pl5{X z2QL<q$^S>X@=k5?^zW3S;34Ogy*nddp1K$vZKO{Ro!iLcXmmh{XqpTW! zMXIWw^&uYihN$|%O`5m|;a%mgOnv^ZnH^o-s(1C|mtyi|M--`O4eW#bFo-O?oJ?TnwVOJx*Q-#bLwm00Vih!L?(Y|`R9|CQm+k+R>?x_h^4DyY3<*XXKa z(L2S#E90YnE30TfR*M-N^kZt&?W8{W_X>SdN z%(OOxO>4C7R41DhZxn@D%?Pu|t!^BqE;A_(3;Dg~Vd_qkGTl9JC;dBd%SAJ$gOrJG z?}cOL+S@sHs=Vsjo$5$4c)5O?y1=aD+D4&1!kX%d8`WcGWqRRsyeF)N9zZa&5rZ2` z{likFqdko6snXQk#fx;!B=`3>_?#5fABB36xJUZa4s~G|&K1w?RJVmGZr<%p^;DRW zjxZ`7VN`t+vc8EdFA%+BzIpI}@NYM^7CG!_G`Aesi-v2X`No{e%EltIj3O1t;M zcxZ=)^)WW8kz693P|m~m#Vc@Mtdglw;Yu-o@=JAmxRTB-Z>kH!m67y*CLEJ;!<(wp zs^s%=e^n=0@o(o~QZ8GS!Wdef@ns>Cu{@7^Qym?ltg+EM2F37hvni?aop#K4&$THN zIp8Xr;tZ{K(5Bea$Gr(fjqb-f+iRW=8znQ*GlWOwUtvQAI`(c#a-_dC&qH>Og_Ef* zCdDpJd|=C^^9z6L062yCDmZ>KsjuPTd5cW8ViCi62GsFJ%FSWf?x$xqw6^NnZi;uX zzm+0~Ay^LkHQKbLx(+9xFs*1$U(g}WqM>Hw$<4sO^(-bGeUlmbTjj=9O^Z~lyl)G9 zwbLP!=M_Ol=P{%T?~8c?}@mwNCTWjZf1skzb0X#PQqx+Geu;!}31$vu=*JJ~-C6yXH2Cfau5`CaPN z9*W)DdXJ~_d5E7%Y2X)HuYMmR-_W>gPR_WAKvdwiso8F)bTOu#Jj4-a1jzagKs$z2r?N+OLLVbJhR(JQrn45R0 zU-iV;@^-7XSg76M9qQCrgE8J`U_w*W2L_ zl^yDLcC@>^TOHk7SNbm}b3fJ+(!7^IK}FLs{=WhxaR>@x3KSj+GXK z1CY(ZpXj8djh%Z-<=4S~S>IK?*I}L(C8?XQ!!q&CUiG`{Fs}pOR!8sgs z1wkCf$6Mp!5)vBM>{j>pLE8uRsOS4AUdQ@xSmcF3cvk;fE)|m26!KRizfn`KSDbyO zeM!dQqb-*Fl^{~qyU_**TTG4a2mM_CjXLLgWwe7b@d*_!MXENE6j%*B-6}Fz>)Yyi zP_n=NF3n~gD7oayMH@Nv;&y@?NITyNsRAyb_t)Q5*E+HOf!n=KIH!m9srJ6WH=R=l z^;L3HZ#z#MfDX7JPOyA)$ra3)`ai^0!!!R0M{sMZ(RNK=#os!c3DR66XFRR3 z6~B*?-Ku`xSDD1)TGc`qwCL-1)j2No3qB6Iphb8;?}8<0t8E?cZ@roST~Gcl+OMX^ zD+^-cS}}{!Ey_|{!6KTVbueCWdf(Yg8e+rm_XMS*PpD~8a0FG^@x_2?KK|<4YK&V+ z=C^&WX1mc}eycj(jqwA{q<7F->{bR1ntB1_#uZUYa!1lL%}R$1d|b+f%Jtb|>;)v- z=#)gY^-~-)SKfZ`7a8BG%lpA1d+$|G^n>QyuvfKvl(qbxy<7HrlvzsDY7B)M>;7#^XzQbjQs@ z_|*ft2ttiYh5#{eZ!#1IeHSK!XTSx?5CA6D(jQ}i!g&eeJs;4aO>i6Um$neRwBZ~V zaWIyCl+V%YFVpMq?5`>4vHn;sF;U4W=m)Sk1*@A>c6@^Y$}uxVSxoe!Zq)iqy-{&E zWI4h%qYsh~DKzR$yiswd8+cpFrIeh3l>gPAX-=)8!=BFvU zi4ofXjp5`0nne~5P?qy$@2KAmfPY={j_OE{o7 zUIgpNfQA7-HAC~OYjt=&LrIOAykAqa1F+V~`_<%Iw8<#EMRCWF5c(x~*t4huEhn0D z^zvmW4@hC)fIZndof`t_R+|Is2y*5+3&GV%!R5gssr`SdAL0$_=$Ro^{Z{X2MglhD zR3N0hA>_GVXn}n0+VJ3hb>cuJ+iNA)huO9w$xFw)KgeT^0p24Rn1V=R7;|P*2^aOqJzklpB%g7%i4+MERsFCD}&pu>mA0EXh*FyN%`D4?O*RF~w@g zI91`eN76+I;kaFy%P+pKF1uZE+g?CD@>kstso6QoWXE*b?nC^Zvi2=57t_9wH|u~} zoQ?8p-lP7Odtc+)=|uwKKys9zcO)C(z-L#{bMhY!sL6vBxBUkl&(W4>kZ(Yr69+4W ze9ZxM?O^z;#P?LE56ke3{^}gSfzP5I{i0eCB6!N`ktUpc9~yxlPgnzb3HX{D)yZQk zk;d!bLyl{z?86w>Oz%as%V4iIL6%izkcW|(z%?H-Tpi{Sk@RKUfSH^oEMII`Mf1&A+erErH z94BKw(8|!0PoObBUrD#U-$`S4zA`9=+EQF}T5tRI`)bskirwbbX^cOqrrwFMAADae zyi*xyQ*=BgXThC{*ZRHWdy`jfzC-C_vv-!Bx)bK*1+@Z1%8<;N0z~9ct?av$^r(fX zNB2VtuyI@XzB=bF^f3Q@b;(_d*J)(cursYTo;#CN>Z!Yw-1G%{Kh!=A_5SyFbz~vD zKl+%d!zF+dT+Pz#HdLfhre@@2&kLiS|2W!$IeJyk~+*yicb0a#=2IYUglF&9=_>pQwC) z=ljSJSlZ?vR+o%Gy=OY{Cq^g>Y}CJ*O(1)lIuhl}j&zJ??MTE1pBz^Aj)Wjk{@q9= z+tK|H_(mo_4PN)=_Tk8FBId&L_lMQOd!V-W9#NOw1G^o3ME(38EXjZqM=2w1QJr*m zj)Hl-dR&dV7fb2eN7UkbLI0g2>a2S)N${P^?o}Kyh4EZa*G^U(gJeDYjD->N;f}Ao&XWL~F}Kvl=#vGNERq@M?!8Y* z&;2=FZQKSuE%2obV0hLq;fTL6(8FItP73?M`(Na@c?@Lm>-M2$M+6gUpj+5hL*KBm z^h4j&Z4W5fC8RrK(?KK_DIFSb{R}$nsg(NI9IB7T#;}ExE>T@6gF2!K{_(ZS4&8+> z!G2++Un#La`Y}S!w3|`Kr*C_MJoZa`9Do0_69v57nv(@ME8UsGgaC%_NPX4OiVVagiwvu|4&5_c!X)iHalna~gY) zcx(ZWT1-Io5B(qOpZ))*z8d|Y;tD(fMY#ZihET}BD1ShX134NQm`UZ<873jf`ZW-u z91Mgl10bKi;bR@fPuT!%SKlUgx9q}%IX|`U_9jDdZ^K%QZ*cGOhDkTBKqmY*(4@zH0 zrhZmI8;J2=@=E`2JfUHcK}7Imkz|d>+ka+_eKFmk?o)Fee?(S|n1^|IA5zxZ4jt3X z18)7)L&%oDCf|FKn@^sk6nekJdx~7{z%*2xmYZ-!%MJdmpU$>RCSfT-o3AE8ZNEIG zS{}ykkA0+0ei){F|3~VnhY^R2{78)|Q<4iw=*@EGU7SK$X+m3}o*gF8VoFGAldeAr zzoJ611^vc0m6H}wjwTHk6+mxpnd0qG{j2M#JIj=GeVMG|huTMYY%D%?EAlM#btv#= zdjz~;`J3|yc9i_My6q9Tn@b<5mmg7A2(!~aT4#eq!?Noy3D+ETs<>c@pddF zoo)YbO9|){|30T*M{Iq6*D^}8#F1HqR zI(324E>nN2*publ(@A(onMYwS(0)dL-`hUXt3CH3yEroy%lF@otIkI;j)@qs5OZ zQ*G|f_o!*geA{TeBil+gvTT~NSB5KX0nPihhbyW0E?X?pSC|PcY%$6R_hUCD^~Y}9 z(=A%zFMq5qdrYy*CChKp+W+d3lG>fTT1b1NjBt-#R8ps1XS!+0ikc4nc=Tg6b-J?HcC2$82d69JQ~#;I8?w|6ndl~%({u4J zB!iqrtxgY;RmtPZEPMS4O*VAoVXM7a-nEFkQT^(1WsqCbx6UtYYxFv4fkyregyBUx z4ZLrjfn~nrg!eI{)C;$PI!Gch*2&zy-l zd%v^o?wRmkz{fnP6x%L$;wL|;Oo}3!WFvI*4s}jFsSJ#~HdS-HjAaMani<%2rRlYZ z<8oz|HSWe6a1-=TO|mrV|EcV1psK32^-ZTDItF%fudshjPU2Y zZ|;4L=iG5`W4y;0hqdQgbIm!|Tyy=;z4mNpDvxNu_~{MtYKV)j5e8aaVKCNHTYjL7 zH_?}t|3HOrijcW3JsCOH#$NbC+;IwqqyETR?(?wv&AjIRs1uLg3%7qH4 zdmy$};9b%R;I^mZWC}X~FD*fR$1kMpCD3KdAu3yfEtPjJQF4YDLchxpp-x~1Tym)_ z0|FxK&%nHD_<5R^iNX&)PeqwxZs23*4T0IOr^8X}#RlPZo-8&LF5)~T*hG<5g=6Z5 z=X7t=hr*T{fZO*)e>H4~mr#r!`7IUoz8gHqW}T815{x*(eP`m!wP~jh2DJdKIziOcj4!=NAvQhipE#&)-m=M(o zI>YD85t@>uJB0T*p4J`0_4tB0LJ#M0NEz>lNtW1=77Hr&squ4xF6)-DRn z1+7i3l$$Fe68Y?W%bzc>E(M2cT!}%`aDqVS*J?HDi>pVVqoyUxP!)-R@P#fJ`gDO4O zMlox}G~e$*AJZQA2-_;YZ=+nqg`8`Hnt+SLbAO(VDDa=)g$-Np);7Ak7QOk9c1m7% zk4^}ct`n0Ze&24iVt&=I*Li~h6CSI_8%)NwQ{Z}-dqO*wgtFKrZ(51TsQO3C>+%t&jeMfoCX!ueL<<3Itssj=7x*QX$P;KREE zSW#Pd=sbs5*gjLlin9I{?GXR zZFKZ~@ywH}iWOI#U?$>^3UQL;I!RQvGCLed;eCp=?AB*^&q-{;m#lv40#z2GH_Js4 zHlV(;FHph;sM|%)m|@Q0)68WXM5_5SRsrgMZR@&#{EcFkyot88QH=H<(4iYjsl+rx zRhDiW&_QJzu?*?BK;9pSw2?!Q&gUgK&CvzKwVgQ5l+gd+%1KDWwSARlq_N&nXAzS+ z=xULeK({{-6Pd__A~c7&9dw{bSON?541@nBLxG-Qp)Bv9)J@nDo1uTxLy^Z=Fq;~W z+fASsyh{_Ah|q-fh-TG5Z%{Te$Lt%dyyuUKt(YZ zX;}$s`K61ry9CE%mW%Z2W?0_qos_>BdxyVt8ofr=MLM$?7X0-^irOMZj$V&y0B3j= z;|Skxs%{N-Ow_HBPbu3k8ZE=sjH%net;M$Y7VyF(;PWkL70Prnm5OZ3qfQ>&YwHUt zXzjLRfEDTGrEpcasng?Ej!b+1oH6u5Y7L+fc@^btJcgZ$mdt*baWI8{L=3Zz>Mym!ahwKBPmj zSmCr`k<;ONhA)?{qw4J<2>F7!fsDKw%!c?t~Q#r$0H+5FxXH!M<(8ZMY_WgJ8E7x<$feAPW*7??QX(V1PR{ks~N0B(Y1WEQ#29Zrl;ct#gJhqG)O))Z#%k)Rioi=0SB1@dmlW`P)ullE+$z*6*kxCV zmz)k`HkIZVh)A;T5z&8_W%4CT-D70Q+5_u?Qcmm<{c_1AI=UAl&a`WkY!@j}w=S`D zqx**?a~r}iVC>~%L}clCVah|pe_p0jc9HC>Zv^1NLhn@zm2Xga`=Ib{@Y;t7aL{Gi z%&_S)o!N&92);}+KE=K$=i%)_o~R;E_NQ1-{^>IK1`RVtI`DNZs6FsHKgIC!4a>J` zuF?ks_rmmJ{Uv);wI~xZuZK>3hWW#t%M@ONs#t+d+!|~=Bdn|uqs=RNxaPd9)KClc zd+ir~oD{ep#*Q#~zlgFhN?)d5e1y4784gz|_@3*dKhhibixAqiUqmu8fD~Uw9*%c3 zdtv>EOFAGT;y%P?zCNePOH}-D8x&g=$C)t@_+aH{#tQK*6m(c#68v9>%f3vB!wfI$ ziXQvs10qE)#NC4!`|kEoYORQgd*%u=DZvtUh1H=gjl=+~OT%0VBsV#kU;T2kR zNR&_TEYQ5)D9|w|Vrbqph4ZuaJVQf9``ph(xsX3zA^$q`HAAl2=hpF=;IS)|_9blc z>8tjlFU2w;Kfg-hhcPu93u8PiBBI7#L-F&Tk}fg!J8Xe$G;W>l)pfe)Dis|@%YNV* z-8_tGdeAj`sU8LhI_32+K!nZp7@!c|t%n2%ryUWC{F%Nr?>Xr*rl+q`;}NXH{`(rm z9YrItj-X{n#q7)q;02Ee$MizP^K&$wA2VOXb%G`l;a9JC2Zf{JjTNyAhw&rKTTykG zLBL4~)06n<5&vc#H6qE%H25m)-%95+^fq{pFA2Y8^ygz@I180^Ok_)~*Y1B@GzvMd z*M9YDu~|rQoz{FKMhA-PP#4w$zgMyX_-+)uX&H;O=5OG-$T$sX9Reznh1{%Mgqr2eoMHw*0Ux&K_a1zrYj z{j(JFok;bbQ_r|kIi601--!?{F$MjCqEKjuu!t0DM4SwsOO{pvzdf>?0hl+J;t*;Z z>ljs~ag6#Ol*Vbc|Dr+;n_i`A4p%IoMh?d>qJ9qR{z{hbMM(Jg#hlksd)wh~FhBk? zhu{kg2t)CUwowZ3>0234Xxv!`IY$khk2$6*Knps~84MMvx4*teKToR)r6}7HxkqweIG=q4}5X$a&vVN(-84 z`ghcL7S?};s#{nKXQ&aOw(G3B7}{wMK=z%b#y0GqopV!`W6n`pD{|j%q(X#hU5h(W zJKo|X)r}V4>P}FjJ%K46fHuF?gL| z(x-#s+99P4AzNi#hdZ0>>7YU+s^fojXV(I{+!)$;4**vR8)yyfVxUP+7(^|tFs*LR zfmQ~qGzVX1z+ng(bj6v%?a%9~2e8cruqBuFO8ViV2r>0ChO>oEzwSmi+kRrepsF_g z4D>s&#T!PmP5d7{RLwULe;I}S#a$e^?-#?w`+m{u+|*~VXgLqL^=HEX-)vT~6-XA_q`f zmq<`+2dMPKS@DQA%EYP8g4UY!@rD^hYC)PonCnrdYm|a6Q2Gs|G=yqc^gT@Tqa86i zrp>dj4})vAtKY47oYNJ`bU@3_=W$FmdIVW6f!h3W1~tDPF;F_6^-ghAqEiO$rb?fp zLSW0{KTG`(&R;!a0>@pYAM^^2$J?m+2F6+I$a^;zUDh-s0V zsn(+dp?WQ;(Qi1h?x48NXD+U~(F4$Y-gM_zBj0ojt;Tu+Q#=5z*qKLfdks1eYNN!< zBFOyWVkQ@=w?wsPG1PSdO)Q-wH5zvTHM4}D4NH)7GFWq=rlp1qp#iYqr7As)aYQU9 z%T@G#%XNwDQ+^V@!d^5@9+KoR$xxd8Gv11OZ8`P-jG8_EmVp&}1I3d;SrqpRcI~HU zk;PwTP(hz~jd~(vBKh1B)99{A4yBeP`3LG5Cc|j*O=xsu7R>wx+TK|_JbVTZUMoFR z@uCa(Rm4+Izo?M5l~j03G^<@Jof%_SIWx{$<;-|f1XIrq;iLArVxW9!eVZ(IFqZXX zbD33YxdEG-{0^ldQk{}>k7=YryL8wSWO zq0L*z`83+p1B31`l4uu{X`gJCKB`u`-b3Q1^^|s>#Au(-k%orUrhJuNz<6XLHzv)z zBf=s#7U*cd*)5!YpVJ++RC^Z9tZ9QmM{J}*A30ll?E`~e=6!Okxkd+on%IT8SJNg+ zxnCBkQ;MOvo8n11r|hlp$JhDT|@epMO9L`Opwa?^~>8)c7D+ zOfNH7a08aJ$|xlO!tW~cz&u^XRzF)y+{%%ex~?_bHU;RN#HcstS8d~~(W`(f}?M|)nNRjmi?3P4W zyJ|k@##du&b-<2&fO%5QGazC}H6JqY0Oabuvpsr(d|9abobe68(9!XKk~vbfetwUn zuTv$HWSUU78S(bm$ud%?0d)qJ-yh^ent2U7<7l70cAsQfp~{9js-7x~w4ORHz&K+% zUiXzDUGFq$RyoTYd*8pvSRtz(r>N&;$iVm!xTtZ2qWI9%=Vhq(#5kc$jKdarD5W7e zM&V^zilXd$1p}$`Pd_eX7WiR7si;`l?K`aE2R}|3ZmPwyu=X%r1Sf7IFr@@OYWOUdx0^ab)r-juPqt+;Qs=XMhVma diff --git a/patch_v2/meowpkg/nyai.c b/patch_v2/meowpkg/nyai.c index 3757894..760af21 100644 --- a/patch_v2/meowpkg/nyai.c +++ b/patch_v2/meowpkg/nyai.c @@ -22,6 +22,7 @@ #include #include #include +#include #include #include #include @@ -32,10 +33,11 @@ #include #include #include +#include #include #include -#define NYAI_VERSION "0.3.0" +#define NYAI_VERSION "0.3.1" #define BUF 1024 #define MAX_SRC 16 #define MAX_PKG 256 @@ -46,6 +48,11 @@ * 每次安装一个子目录 ---,无论成败都删。 */ #define STG_SUBDIR "MeowOS/tmp/pkgs" +/* 单包解压后体积上限(防解压炸弹:解包先于验签,恶意包可以在验签失败前把卡写满)。 + * 现网最大 App ≈ 6MB(ncm),512MB 留足余量;另加 statvfs 余量检查。 */ +#define MAX_UNPACK_BYTES (512LL * 1024 * 1024) +#define STG_SPACE_MARGIN (16LL * 1024 * 1024) + /* .mpk 签名 footer 布局(与 patch_v2/meow_verify/meow_sig.h 同步;此处只读 package 用于 * 「footer.package vs app.json.package」一致性检查——真正的验签仍由 meow_verify 执行)。 */ #define SIG_MAGIC "MEOWSIG1" @@ -111,13 +118,20 @@ static void strip_comment(char *s) if (p) *p = 0; } -/* 包名合法:仅 [A-Za-z0-9._-],且拒绝 "." / ".."(否则 MeowAPPs/ 会越出安装目录)。 */ +/* 包名合法:仅 [a-z0-9._-],且拒绝 "." / ".." / 前导或尾随 '.'。 + * 只收小写是安全要求:SD 卡是 exFAT,名字比较不区分大小写, + * 允许大写就能用 "OS.MEOW.READER" 落到已装的 MeowAPPs/os.meow.reader 上 + * 并绕过 is_system_pkg() 的签名门(现网包名全小写,收紧无兼容代价)。 */ static int valid_pkg(const char *s) { if (!s || !*s) return 0; - if (!strcmp(s, ".") || !strcmp(s, "..")) return 0; - for (; *s; s++) - if (!(isalnum((unsigned char)*s) || *s=='.' || *s=='-' || *s=='_')) return 0; + if (s[0] == '.') return 0; /* "." / ".." / 隐藏名 */ + size_t n = strlen(s); + if (s[n-1] == '.') return 0; /* exFAT/Windows 尾点映射怪癖 */ + for (; *s; s++) { + unsigned char c = (unsigned char)*s; + if (!(islower(c) || isdigit(c) || c=='.' || c=='-' || c=='_')) return 0; + } return 1; } static int unsafe_path(const char *s) @@ -127,6 +141,8 @@ static int unsafe_path(const char *s) /* 前向声明:错误前缀(install/upgrade),定义见安装期安全设施一节。 */ static void op_err(const char *fmt, ...); +/* 前向声明:独立 '..' 路径组件判定,定义见导出过滤一节(安装期成员名检查也用)。 */ +static int has_dotdot_comp(const char *p); static int mkdir_p(const char *path) { @@ -214,10 +230,10 @@ static void fmt_utc(long long sec, char *out, int n) unsigned doy = doe - (365*yoe + yoe/4 - yoe/100); unsigned mp = (5*doy + 2)/153; unsigned d = doy - (153*mp+2)/5 + 1; - unsigned m = mp + (mp < 10 ? 3 : 9); /* 1..12 */ + int m = (int)mp + (mp < 10 ? 3 : -9); /* March-based → 1..12 */ if (m <= 2) y++; long long rem = sec % 86400; - snprintf(out, n, "%04lld%02u%02u-%02u%02u%02u", y, m, d, + snprintf(out, n, "%04lld%02d%02u-%02u%02u%02u", y, m, d, (unsigned)(rem/3600), (unsigned)((rem%3600)/60), (unsigned)(rem%60)); } @@ -366,7 +382,7 @@ typedef struct { long long version_code; /* app.json "version_code"(正整数,安装/升级比较唯一依据;缺时 has_=0) */ int has_version_code; /* app.json 是否显式声明 version_code */ char exec[512]; - char package[64]; /* app.json "package"(权威包名,== 文件名茎;II 期绑定校验用) */ + char package[64]; /* app.json "package"(唯一权威包名;M35 后与文件名无关) */ char author[128]; char routes[512]; char services[512]; @@ -860,10 +876,14 @@ static int cmd_list_upgradable(pkgrec *recs, int nrec) } /* ---------------- II 期签名校验(MPK_SIGNATURE_DESIGN §5.1,shell-out meow_verify) ---------------- */ -/* 系统包前缀:os.meow.*(防伪造系统包名;独立于 valid_pkg,不改变现有合法包名序列)。 */ +/* 系统包前缀:os.meow.*(防伪造系统包名)。 + * **必须大小写不敏感**:安装落盘目录在 exFAT 上(名字比较不区分大小写), + * 若这里区分大小写,"OS.MEOW.READER" 会被当成第三方放行并落到已装的 + * MeowAPPs/os.meow.reader 上,直接顶掉系统 App(valid_pkg 也已收紧为只收小写, + * 这里是第二道防线:任一改动失效都不会打开这个口子)。 */ static int is_system_pkg(const char *pkg) { - return pkg && !strncmp(pkg, "os.meow.", 8); + return pkg && !strncasecmp(pkg, "os.meow.", 8); } /* meow_verify 二进制路径:环境变量 MEOW_VERIFY_BIN 覆盖(宿主测试用),缺省 /usr/bin/meow_verify。 */ @@ -1063,36 +1083,106 @@ static void scrub(char *s) } } -/* 解包前逐条检查归档成员类型(tar -tv 首列):只允许普通文件 '-' 与目录 'd'。 - * 符号链接/硬链接/设备/FIFO 一律拒绝(防「先建链、后续成员写穿到目录外」)。 - * 名字穿越交由 tar 自身剥离(busybox 1.31 真机实测:'../x'→'x'、'/x'→'x'); - * 解包后再用 stg_tree_ok() 复核暂存树。 - * 返回 0 通过 / -2 成员类型非法 / -3 空归档 / -1 读失败。 */ -static int mpk_check_members(const char *mpk) +/* 解析一行 `tar -tv`:`

printf '#!/bin/sh\nexit 0\n' > "$1/bin"; chmod +x "$1/bin" } pack() { tar czf "$2" -C "$1" .; } +mk_evil_tar() { # mk_evil_tar :成员名可含 ../ 或绝对路径 + python3 - "$1" "$2" "$3" <<'PY' +import sys, tarfile, io, gzip +out, name, pkg = sys.argv[1], sys.argv[2], sys.argv[3] +buf = io.BytesIO() +with tarfile.open(fileobj=buf, mode='w') as t: + ti = tarfile.TarInfo(name); ti.size = 3; t.addfile(ti, io.BytesIO(b'pwn')) + j = ('{"name":"X","package":"%s","exec":"x","version":"1","version_code":1}' % pkg).encode() + tj = tarfile.TarInfo('app.json'); tj.size = len(j); t.addfile(tj, io.BytesIO(j)) +open(out, 'wb').write(gzip.compress(buf.getvalue())) +PY +} +mk_bomb_tar() { # mk_bomb_tar :成员头声明 700MB 的解压炸弹 + python3 - "$1" <<'PY' +import sys, tarfile, gzip +ti = tarfile.TarInfo('big.bin'); ti.size = 700 * 1024 * 1024 +ti.mtime = 0; ti.mode = 0o644; ti.uid = ti.gid = 0 +hdr = ti.tobuf(format=tarfile.USTAR_FORMAT) +open(sys.argv[1], 'wb').write(gzip.compress(hdr + b'\0' * 1024)) +PY +} sign() { # sign :文件名茎必须等于包名(meow_sign 约定),签完覆盖原文件 [ -n "$KEY" ] || return 2 mkdir -p "$WORK/sign" @@ -95,6 +116,17 @@ expect() { # expect