From a0ae7eaea838c3e63a4dca5b25d627ea1224045e Mon Sep 17 00:00:00 2001 From: Connor Tumbleson Date: Sun, 3 Sep 2017 18:12:57 -0400 Subject: [PATCH 1/2] Skip any file attempting to use relative paths - fixes #1589 --- .../androlib/OutsideOfDirectoryEntryTest.java | 71 ++++++++++++++++++ .../brut/apktool/issue1589/issue1589.apk | Bin 0 -> 32296 bytes .../java/brut/directory/ZipRODirectory.java | 2 +- 3 files changed, 72 insertions(+), 1 deletion(-) create mode 100644 brut.apktool/apktool-lib/src/test/java/brut/androlib/OutsideOfDirectoryEntryTest.java create mode 100644 brut.apktool/apktool-lib/src/test/resources/brut/apktool/issue1589/issue1589.apk diff --git a/brut.apktool/apktool-lib/src/test/java/brut/androlib/OutsideOfDirectoryEntryTest.java b/brut.apktool/apktool-lib/src/test/java/brut/androlib/OutsideOfDirectoryEntryTest.java new file mode 100644 index 00000000..b232e40a --- /dev/null +++ b/brut.apktool/apktool-lib/src/test/java/brut/androlib/OutsideOfDirectoryEntryTest.java @@ -0,0 +1,71 @@ +/** + * Copyright (C) 2017 Ryszard Wiśniewski + * Copyright (C) 2017 Connor Tumbleson + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package brut.androlib; + +import brut.common.BrutException; +import brut.directory.ExtFile; +import brut.util.OS; +import org.junit.AfterClass; +import org.junit.BeforeClass; +import org.junit.Test; + +import java.io.File; +import java.util.logging.Logger; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +/** + * @author Connor Tumbleson + */ +public class OutsideOfDirectoryEntryTest { + + @BeforeClass + public static void beforeClass() throws Exception { + TestUtils.cleanFrameworkFile(); + sTmpDir = new ExtFile(OS.createTempDirectory()); + TestUtils.copyResourceDir(DecodeKotlinTest.class, "brut/apktool/issue1589/", sTmpDir); + + String apk = "issue1589.apk"; + + // decode issue1589.apk + ApkDecoder apkDecoder = new ApkDecoder(new File(sTmpDir + File.separator + apk)); + sTestNewDir = new ExtFile(sTmpDir + File.separator + apk + ".out"); + + apkDecoder.setOutDir(new File(sTmpDir + File.separator + apk + ".out")); + apkDecoder.decode(); + } + + @AfterClass + public static void afterClass() throws BrutException { + OS.rmdir(sTmpDir); + } + + @Test + public void skippedDecodingOfInvalidFileTest() throws BrutException { + assertTrue(sTestNewDir.isDirectory()); + + File testAssetFolder = new File(sTestNewDir, "assets"); + assertFalse(testAssetFolder.isDirectory()); + } + + + private static ExtFile sTmpDir; + private static ExtFile sTestNewDir; + + private final static Logger LOGGER = Logger.getLogger(OutsideOfDirectoryEntryTest.class.getName()); +} \ No newline at end of file diff --git a/brut.apktool/apktool-lib/src/test/resources/brut/apktool/issue1589/issue1589.apk b/brut.apktool/apktool-lib/src/test/resources/brut/apktool/issue1589/issue1589.apk new file mode 100644 index 0000000000000000000000000000000000000000..e234e0dd28aa102bb80ac27e948c5810540d120b GIT binary patch literal 32296 zcmb5U19W9g*Dkt~9ox2T+crA3ZJQmtqmDba(;eHk?R0G4yx%$F{ut-`?>)8lT)W1o zG3Q!)Kegsl^I4@N3j{+0KtVwPfWD-%fdAA`zxu-Vrp^vlrt(JiR_10dt_+@bwz0_* z_H#mLVN=W0^2r~CR@4D{wGwPfFi>vLD6pZefHGPR1?iuq($)jebSFt>gn^WXeX@7N znyw?68i5Y>6!m8+&^kjNz8CRR*}QS;3pG*ujb+hNt4jW{uxD-C)Si$6L9AEszK}=T zpl=X0*>@1W0E=zBH?Xn!PWX!uy;{gqwNuMNIsRd$z0Q`vJf#4?_u$ha5OxQ zxtSTric&`2PwMwQAq?`cO#r>K6J{taJ~Q<`KeK!Z)aL|41=;*Q#@C@&b!zRtbsoi? zoN31#v98U;HQ$H294LMpZ!H?CB>9cMc7HTzt2G{{f3?2I`g$7bYhVNWM6Gy~sSW8L z)fv6guc)VvSocVB#L+_{)k7Vzp9K^&KKizw2LI4wlknk4zZ~QB{Zo7Uy{Xqb+lN6e zAEWY7ojZoXakDzpdZ41G%d*66lpVAs)K1~gU{yE0$&$#r_Vo24Mb4QfB2PhZTxp&O zsiRZS?fu^LnMm1U<&t+$*K@qS!~VTx-A$4Cr+i{`OvRz@+*;^(sQ2Kx86!?FeQ}|zVN?u$|m|j{zf{}sYKR%-3 zDryWWs=}<6##&Q@WebNh57}vn*;c}+W1t}vsoZigG2!bFS+UFpuC4QdnAPElxTOPlwxBLlus@kpEo<`wK?o!I$j2|z z(^OJ&GmNRsi9k_|Fb>0_sD2kx{3ym9j=aUm#KFPR!ok7D!Tl*2d7BydJ6wt38G@6U zhL|@g@kh{~$i!R_s>y-*{^8+iRnzNt5Brz-j<#19MD7XCHVcniyiWUQyY^rK%2kVq zR$D>dg&m}=L(2Tlzwx3D-kFfJ;MIsn=O6a(yP}WmX(jxN{KnW0jB0+Z*HpsVGUtIV zw)3l&O@=BF+7dN_l>`eSluXTCLD(0S^#XxaePS&#>FMHtN??_U7L`WDWj)YEw~Y4Gg!G zcuqxaAi824>Y~+Zt-MeCvNuo;3n`NrcN33xeBCmqVN~}rHP&?N+|Zw)a6H&>Q3+oRdKbLS;DOlK4JNfg zS_CC!z!UAQOO?&f+j*bX)4HFY_gN}taPopM7W5vQDXb2Y2cDN>Nkz`_t@`6XX|JF1 z;%_@M*#~{yE{Nf;+q$ZCJxd#(^>=0?=FZF8jVh}sRorcjn2pVCb)2iNM&Dp##;XEI zJxbOX(z2E~)d%I?aW4NtTNoD?ZRyh<+?3Ow3~8LRzl?-e`9vS4vrtW(oE+7kWSo$< z3Lk5&E(ku}6VTrekp2wr0HO*k;X=(5`y%K<40$qXl%YbkjnMO;u+ z21Vs-=;UMI>b^POG;=g4@()-3`K7({vhkUc<>_56y{zm1U2E_`#y7y9lfN+`-t z?{0nSC*`t=0t50hJ%J{Qb*|^`(cZn5O;@_k%`2A2$20o+FRU_y;dW6v*f`t= zq+`Ljf;No04Q5qo2Q21-%?*2H8Tn5q?-fU4A7+QHzn|aNMsd(lKV5tVYDNj}b$mZ< z+Z`?qKz`Qu55HJ^vZAef>nvf|XyGZSuRFWiO#4IAo^iQX`@ny{#Yf8>vCYIPHK03f zwv}=Je7nd?D(ZZOJHeU66a304kWg}_)Arb3`K95% zj}#w}sjSS)RA@XD3}Va?j6zpU8S_FQ3uravyGEZc7vrR?c7y#J8|#<8M|h4Y!urZ& z1juGwQxv^k1|TAEUeix`b2lx7ozao7GlSB$8pYD*y}43)(I4jcZm*<9?t6QP=Lho ze}I@gn})c@h3BV!hFn3L{skiCJzQ+1D$p>=&*7X%PdIdN5~$hJP!IXt<*g=fWM1P& z;)+Zo9jbepgCYIc%A+_Zw0*#H7qcrk#oTWV2Cke3&M+}*Z*(5)>Y@B{sq>oHTueb=!E!r(8wX2! z6Z$9Nl6lWmN8TsoL%hX=Efi+OlRxD&--rbcT!N6kL&R2A$zhPF;K`?8?bXcRlWsxgaGPwHX*?Q-`ZvSHnu_){Xgoh69kKvHzVi)qXhQlM8Vg@7-m@joVq2Mo z#KG6&7syw)`S+Xi7IOaG-^%G%8AynXGE7&cloVVM(dd>Ff4`7x<{DGXg?n!@FocvT z)_&@1A_!q=;^dURNo%vy4EG{r$-yU{Z91EsIcIepw~$;4OR||D%LIy~b|GPhWpx3O z?BgGrp6%=7?MRaj-J4+j7QpT|S;K$rABr`yHiY#?3`*fjyF@}5l7 z9ZX(Qs@)fK)BhuMC|}V1XO1^=aWQjs0siYz{u%;&IsdEud+;&7#{ZYsf2l^`AwuqmAA9OdWKf5EA&zI!!Z3)gca( z<{xqXFrDd}rWi&9Ij$92_STMx)Xlln<@M@eYyXlK0?CG%Nw?fe-#t^b!60M_33NOx zBU81W|KHuW9xlFrpz*1v(R2U0OEvQU>8WD)|N0#s4h&|Vu4eWwRu1+I=2o_5up`5C z-v9+-;A!)XS^Y`#Xkm@xS!(^kLY&{QiQL#dG z8gCksd!h(PM40^V1TeeeFdy6pM7zR_Bv>=iYK7b6d0U*9cC30yTsyb^0b8GbmqoUA zgOjoRqBWTQUDqcXxpo_PuZOXSK3!P0Y#3V#n*m23u~f>j5gciQZPNZ8@&zSQPw|09 zVNzkf*esJS#A`%dA#6mdP@8c`?@%ihsP{p_ju0_HR!opsnn3pLp!jb7E8K`*A5>JJ zgzKQWA$C`=o&firt~_8i0VL26%Cx6p+lvVn0{|rW4J`o34WxI3^o8yOU)%N(9VeGC zwm;7Ux{mvEt&c0s!fG$DfaF8Z5r=B~SV*5ixT2!=c?MZ`Oj;?9h#Mye(J3(? zue!V{a80=F3wwru zyPSkghp6YAq@>&A^+$ak(He?z!>~o=U#t5}xw@b1kgpZ9=ILdd62zV6RQ zkdFZEw>RCeu566g8VsM7fjH~<)po=W-X#giN##4=kvhG#fVh}j5qAZQ=&-lD{i3(^ zfrB@=fnto?u#5v)Ms$~ybn9gWuh!E}5;h;kuvR( zRa*5f^Sas012elR8_i#e@$nX-3zU|}3H{GThp+e0JYJRxWv6P1Y`&H%1J&x9=b!a_ zUG{BQYM(}0zT;+xw#ym~<8BoKx98KiIYpYBt0;yd`QVsu71{tF~%F!wJ$a) zP&%xY{y%0lyA!8D?LbJZ2^noV&w6hnTR%NkGK|L|It7#8e8t?{o?AJSC(Z-Q<6EFZ2i-@ zSy543#al+UOyb7W`AICvmAuT-EGyZ@EDVzd2D}+3<%Khp@v(FJMY(v%PwY z{fSyN-wqdtjWoih)&tIeaBY_7ZbK-(h;-Tk+#?y}ymcuc* zIN1y$K+ju2CK5vFxr(CD* zzS?+o!m6bFIo?Li)@%Fa<)i=QV=KsujKK-5-$6f}Y5Pab8ueQar`>ApwqmaCGANN_ zRxk-5h>)MF!fT$2%Kw$-P2Y2q|LDE!j`e0c|_0RJa? zm)%`Oo}ov*OUxinZ_|e0=S7vv_cUb&BfOiF4v?b=Sc*380eqT)*d7?pi7{ zkPh1Eurl)q5E_Sy4h_hc#$4*?t_;Cmz8d290Bmo9_5+d_1wSTV-VI!2{k=0XBq_4S3v|w|*N)|x{s0iN zH$ajf=q!k#V_q1M;TE#$gSH9KJjw z%ZUi3Pzj-#@6Z`I(0B_V36t5GaUAqLynFbwaUHyIzAtwjH5ZV1*o+%2N{cpB4Vc+4 zrBKJnOeVLdz{m3qw>w(EMyiWUswuZK0(eM|u*awWMY;dPC|2Or$XeZPPWxU{7f^}b zoKElh-RgZRlh@O`P$7r0ca<(%P27UMCigGXFbdgm0?H|~m;9UM=>fdMU;UQDm3v7S z!;xshEPk{8`7544Cribnu2h5TK{LPu51eKVfJMIXFpIlHzVoztZV?K!v2gi*n7xAH z@2VRcgiz;aSXlBaJoGw+Mp=Uzy-|ZQm+vmDnl`=)%^{XE~t|7sTlu$n;J zq%P>Y^A;}#6>^s{N}KA(WOC-y)(kji652fjh=rTjYu@z#eU;2!xzrAv`5-4awmgch z+7pRCmN7;P0bvL&bQLmJK+j*k zVx5c1VKtucl*`#N_aXj{(;NDn24QF}#TvjjOJNr^kTf)^u0Sp?Czs1xW;7{p@`+Tb zkYnP`Rnq{Dz7L=9GdST_iP-mg`vbktcIVqeyYKLnlLnAPphS8eujG9SxvGzGWR#FA zKS$#nX$}IS7JtC~)qEZ8IjIPEUL@#~ehnu30XzynxRuBiAZ?X~DUAi+L1QZ&U3Tw* zfT^l>lXEq)^Sd35=e*!sTnpT{N%iyT@7LOi6*<(_;2P&Y4Zw54ULuo@Z_L7LrKn{4 zv|meQH1Q7>7gW%0J-&&IO+NZogId7G^+PTG2w`+R;8Z>KQZAjPelng&2Au5l?2NPl zBi1L@v}ypRnC-xG=-@DbkCUeqLC^6Kn>IEkmqy* z{a#Q(JhFJQ<7i+EBQ4X3O5FJ-_EC?=|5)sRvwFfLoJ8G7cTX;+stXXCxD!!?K%74? zsutfd4-RQ8GDnWJ@u@pcGr@)T34>Fj`vbQc6?0zVO#j1kPUBqvJy9d6AU~hj`*9R@ z3)Sd6MZ^$5M7Ct;ewJOTa>^=L=8fXu|ID@8D&Ur$E*tL$Atq@uIITkzZJTtZSr1U6T7i32O(+AB5~|1)e;J_Jj|>}qMZ&|P;|n+EffgcPsqk`NCr z5-rz%s5J?(fPruMd37c+#~PPU!GFA>?*UXQGhprRwg>>>eIg+e%l%P&>U5lemKd=0 z%L#^t5f3eU^)?w%cCJKHU5o-5cdQs!zhSF+X7FirbqKfzo|# z+f!L_unZB_KyQ3}9WZk|6H+0{&ej8);7qbVyW_aB1jbtMeq32>B(Lrd5;@{B7)Qrm z>Y*3>6sYQ&*z;GG|FA{Xya~Z&ZyQ4D)FX+nS<{01$UvGYL-xv=s`ZdooIj(~SIjjA z7jlK3_}d&&e3@=%vFm}_Xydwn^xZGjn3b$7hHVUcS(P7)+9z)@4c5NhMh|NMAIe`U z6*|B7Af%)~nDZ=p)F2REzhNLnNKJHtjEK$T0OxKU+xN>r3pJkah3B2bG!PrzJQAu= zk%M}srEBl05-~GbyZhrzL{jWZufLgY;o!!mSfSg%B?06qNk_&n=$E2GAs4GC^BY6} z6|H9<8D~j?Dq)79pbL=xs znINX>=w`gupQ{A5L5<*% zhnvLL$EDy=^3oU`HQmX}I_w11_@HGIWo(!-WZAL2BbIL4!FW;D=TlT4cQkC8P_8(r zg8-8<_xUguS7<##xrb~kl@m-7tdt3~il1)gO~!Uoe z^NWmM(djQ|tTOQ&%~-!JI@lZm>yPP%xY<*sD)|O(4Tki4GxMLH*X@He$Z=_AQM&8h zd};-SlydAnUd3jyewA)!CWOt@g9H&cb;#I<3uBHn1$i-lsI6}6pUFrdslYKB_6gq1 zX!15gRGSf;-aLYL$ktVR;_Lw9!6*OMpuZ>NQX~K zxoE9k#mrynR2{_CG;v;=zo;d#n4(@ccD$>>On{EWn!fj)Gj>!k9^YMtWuT`44n@c5 z`XSk<)lD!F14Rnt29XvEwc|`6Sf!S3K`AdlxGIw`Ad!I6d)NCpGCU4Rv(laws?EK` zeLXt(E)-Lj%(IWqvi0|>eEFBbW4CzrFe)DQksWFmwyA4|#2_O3`#v#Em`D3Y6Z=0M z7Cf0MrZ@<^p&1k*{%i`}e<{^=dnNFA=vAM-^TAFPo~4UNnhO=>}jzw+FHmy30IuAH4YqEJ{*lh1Jful^}Ahbvwjd8)6fE z(<>o4-T>B0(zA@sn=Ncgrz2dz_>MkqE!aS4|`vGrU{zjHpcg|{jt+~0YM?V2% zgZ?JApCip*wE#d`TtTc_#4z|DWrf{8q<|9+0ATsDe=lzYjeDnm3tpT7eDkT(C6A(orxT6QsN3)udfE`sLf7Uo8nOJ*L4^!2dKV=61Qg=iJB z7!i$F1xWL$t75Z+>`A5bfzZmR35K(cb@_I-s>v8KmUbpOCS@E}@OMLlP)#VS4D&z4 zHQX2NAs>7WC$p9aA2&06j=s!7FGi5-=gJ?KOKz8(qj&E~ZlJEi(pt%EzvwGr6lk8J z5yNVSj}KfR6gZt+?&bS)kDgu!t48PTeDk1lmhpxm^ z${?w=^F&OL(xrsJ)^dvvWa`^QPJ_02!a+?VsNrAV^?lCzVD~5sn%Ymwa<{se`?+Xt z%OlLDU>|K`DC%}*y9NzD-gjCiK@CIGspO&=I*Q8n5_315lF*o4-c}w{@7~KC)|o-H z3j6n_{C-vM9Gb#XXM}lKk%2HJvP{llb^1CvA76ED6<0aUa{J$(KI|`w(n8!O-4pUX z4Q3|h)4l^(T*Lzb<7?NZmwh(PYy!MFz3~tB+z(U$uO&UZ)z)kqhqd~02M%Ea8M zZBPz(tVE$e;gj*gm$P;CkAcMZPd=B6^*?w3r)|VXfn3Y(zLL0rr>9H**IzEicao{f5#!j zpOvY4|JVvLlnPOgq3r0z;_&-46=2!AE^^+)&m}SrzPkNOZ8>)z<#0$X9D&Y2HeY*j zkN3g(h>wc-wjMH2x4e!HJ%dN7Gr|R^n#L;aTDn(odGt`3n##*Ll;h6Nx+2CfizQzj;vF+js-y zBN?}Uoq%9D7Z=>i_EA>Tcc#WftO=Gx6 zkzPTkiI3=97aigQ0wL(cRSW_(AQ8Tqz28TBFWgrLor>OGmiIoT3RT7<_3l8e#eXgQv+%v(CL=(x;pE?=@8n zC0YkirLkkjfd;e8fjcAqOYezgpCZlzV4k!^W67V?KN00yN+AK3MlOM! zAImR`DgQvAQ)l}HJY>!otr$45>#2OZwCyeHZ$c3IoV=QpSCJzF#}T?3l!ep5 z_GfKHD$t5=O-q)_p7qE=izDl*$||uD@lH?(Ep5gM^@7AL^SIOw!@$C2Oku&HxEriNEh@xN z8HQPVMNT}6F^mO)g_0C11!@N8S%a=nyW>Y8Wu&_J7tbEW`G*}*>9aP7PyhVA-!Q9Q zMJtZn1Ln*fG9qKgZ$4>h8s%d^5(w6Vz=Q&442#VTwTi(YP`?{h^=c1F;dxUC0ROuU zEk`G@l^=?`x~7l(yO@Zg=r!obwLx_T!pp5UiosrGX1YA+K+cJ&fF?sP zM#gWp_@Ju=@^b(|F|?}BIy6sQoY+-JJczX0NbBKuR>lTJOZAcQ_mXfeZVa9?igMl5 zX!2=w zK}N()IP@q(EQ2E2ejl;`T~AynB5?B(Y#-Gtk4XtU)Lg#jZ*6B)ul?DWN`(fn69>^0 zKBSKzlBzsX;qZ6qXm!0^nmhwje$;&!?KjH4VaHMyZFyBRRn$V$wELAwWZDO5nUVta z7>@@%=U3Vc%22r6dx=syadi5qvVcV;_$Zntn11S)?{Wh(K7P~JU$|v~SG-y~p zm71LHP#b&>aJK{HDFd7PBOVpA1|ml$Ce}>quqlA?Ldsu#Ayhw>a#*`|CG7i1}ttLO6kNx3IAQq@JdC>88vL(@7rf6#W`V@d1lp%+)PZmakZ(godD3PXP1(PW)vw zdwgY(06^iF{d?jk{c`(H`lIK+6Ce?guP^=&%y0PRZul?e-%a=60sxQ}{(>LJ6W^;;!t-4|e`}qS>P%69LILb_yAGDOPliV{i@ssE z+TF*e%Cn8*W&hf)*wSCyJS>Cr=lq7vg)Z-}Ux)Z>&^ukN4pbbJ~anpXA_izK_P%)z%whgQ=^`uKKe}x)u=F6XbZ+W$$w~ z*tr?>3!nf3)g~OMLlF^+kiEHdecj{1;US0>5E$su6Sepqjvfi28)GmZ>pM)h37-Dm z6}IHx$7Qbt*IY+SP;kH$X4;Z~Ou3rLk2U?{kCA-f#&`HDQTqwtIvZ>+mTyzBmHeaq z%cujbq^IN%!Q7t^jL)ZHO8rq1?lP5Xxh%~Ry}B2h33+)wXN&%Oap8T9$=7CAcw4>U}N+ew;!A^Lla?ejZa zoB;E10qMdT0ICW?%}o}6>vIvBG=oR$9ob$q3}kHPodN3dA?)wPNigcyV!gmSnNow5 zMhDr;XvD3C>xAn!H5RBq7L&oJ(;tGlosyQ`^nlt)&#$~a8#nRV3_ONFV!9Ywkpf^B zn{x#sR|M2O0o!2VABYH^mB2nl%p2F(+StmTE#ms~dHAVUd?ZJp zSk7@L{Yk`Qf5yn}Gh}D0GHP_cJ)jlf>~I&`$gzT@;jArK8Z!P!BjA0Sy0qi2h3%#s z0CZ{MAbFSrXh7IDn|3PVV=}k9xFGUK*p6AU7&^w|pocYpDgmlt;SqBEkdPjab{|U) z9gVAw?SA$W0!7mR7iHeZoK=^Zg2XK%@q8+(S#ow4L`17o)bAqg{`aZsB`=_oa@%9Z zfuvDTe86d3NzR*CL2CnX0z`CJzSmg?RX=`x?fW^#4b2TTdU<4>89DK~2z7^-&7@Q- z1A9;5@*rmJq82g)t_JA(a^=F$ngIXPtKcoc_U8!X_bgNaA;9z^-$PY~d~z?N6f%za znCpJy=Y_bCf;E_p-}lYMBSFX8V!Z((VKm?yp}_MaY$heReiNu5P{kcc`zYFk$BvR8 zHKm)^?sP;tcElxBl7$Qk1~~tq?DF&4c)DspCKm6Enf5YAaqK_j+;VW9CBsCi2m8c*=WRAh$X z7{G!i>Vw(c_2|C&`w80(3{!4-xdb?L!elYJ$mr>12b^DGbV%e(t5MFf6cbc!dC|>N zdHu|}mrX;cK&){#wjNZQ?ERa#LBZqGxG_Lr^njFM>pCSPOgP3 z*kvRwyuIesdBo{Ue)fCoK3wXG*^+eUP$e)=8e;! zuX>ITF76qPVe5@1Sl%wLby<4tH|RvDnaHlO#p}Uc(8gSv4i=G`I$FOvv)Wo9PBJc@ z?9Z^86|5{6eo<2%Z1P0`6Y<^?h!_kgQTkSxH_OPgz+-5F5%2erp7?y1Ve+fFGZAk< zE}Z+}h3ITCz{d}XW=Xf}B8rh~0dyyUZYtt>^^psFT~5+^W#xXT5^>q1EF=V={aAoCkFN-h75q_e7K|gQ zuJ)@xEF&7yKT#eHSc;|h%?#2&2kZ&AaaASc(o}y3>yShypmLt=)n?-cr1xlvW|Hsf zIqe z9ft!I#vvsUTT)GS9V|x%6~YsoIAr2Dz>5$XH)J`yO<6}MnI{)qTURLHO~UGr{6IEK z@2=a3Bq)htWX4blWKmz1kzShx+|=Hw1IVCy06;nE5LxoT$hn?)5Lt831UPRvkPx`y zl-E5X)ZsTcmQRz}r>9#iP%x2T5RQh#3G1F+o@ky!Dg-htGC+QUt1M7RPDL5I6Go^s zbUKfXARWfBb)TFXoHz`?vO$|XEM>>|hhBz+T!O2pOgx4vYBVOFXWZ7w&gj-Qm6<;N zAr{>y;JaBoKs^{tm^jb&cVIblFp$NMLvGPLf=cTib$05cFi|>A)ho}n%9tr4siy?X z6=LVwoy&;l@3zBvUeyE!^$3unzD0E4!dob5;x0veivo$jG&-F+`8~b@l}cI!-V|k# zobni&gxg=S9(|uJHaZBClm-*T_JLgMSE*~5TRp#26SM%TIC&Jj)6LVb2L`-txY=BN z#gstGVs7bGWRLDzuxZ=Q0vr=(-xSA7(^h5)q@SnfLAjU3JyauN7Yx#wLQ;)q%$r#l zOQCqPxwigEe&4yNh)3lBC7VB8@k`u7V)6pzOqB$dS#(}(M_GbsU_h)g1Pxp*ck;#! zn-la7R$d^A>@!kX2_etrC2g-nJvd4(Q_1;L$PWf_x4e1!f=$St^o~Q{_Szbm8{*fqEJFmI>{yK7X$NNvJk&;?fh$Cv%8Art zPGI62lBH-_C-r?(0DkYWIvk41sq`wME3Q~TcR!F#$`+_Y{+S5OTccq#HAEN`w2 zwf?@57%NDh*(vEVYnsgcHfA3NZV*6T>CA}+7hbd}$~(m<%_(=0AV(1^@0OT$f6)dy zLotJlgwSdmhMEw#aJ=JSDP`K7s*Eu;eQaW*y_V@!^m%A>-J`1VFQ!2$qES!*vrC=g z>Eu$e?OQFp@I$g7D3;!ga{(<`LEHyg0_LKs{(ao36o|Km;I9HYg{m;sfu{i=nDe{A zvDVaE9dsrGBzKA()R+tjs8UbHdVt(J$Kha`!6f z-3rMY1>#=ZBOxu-@@%M3`I_XmJTg2rbI8Wc(R0aM-dfdGYQ*+^R}!&HHzrjlH~qg(i>#(VK~&puLsnN@OO~F5E0TP z`r7Ugi?_V+I%_dilTrOV4}p@h1wpA}orH3LWtAORMZdSPzJ?CnU#++ zqXDU8MI9+O+d__4zdU>%0&1%&P=y!+QEQ(U;M-U#iC&UsoyEEm_BlzYg7QH{NBhD@ zxWTvCZ2esZ89rR-H29d(j*nn4u%EPzc3#P2B!sfRu@8`Vm|?WB?>~ zW&LKQw_u*P50soF^ZunA{4W{7nPT)4C~w)+a;CuQ^QCtDmzOJ4q4i~`$N&Jsm;HN< z<)7`h|5;=Cw<3!HZr=X?L1anz@=y4e$Z{mH`x^kjrTE_>OSadS$kH*?_4w^x;1!OQ z=#_+qC@NwmFgQZlM9hg4Ck+cV4b#sW#Ut0rM>;3d(|8`0lsSPk=uwx%IwrCIcR%@d z6bLDi5n}zsrjGi?>&NkF#_4JK*KvB9Qx}jU5VEnL?(w|-rL45MopC5Nm8(}-t5;|* zlz;p0UGSKc>&%rd-NzPdU@86pi&|!RKoh!!dIVkz=}eIzmE0C^f#G1FE`Cb;yXwirT;+e6DnMp36 zxV*;kx3rrf0{?38su0pDf`fTl-4*)W3dE2dZaq}Un!nQb0LR@T1wEhESIB04 z%0K!x8UEPJR8{zwVF!jF5COWo7BAy!p652(G8o!TbbCNlj|-sZDEircm6nU(EU}x7 zF0U%9h7ECRxY|LszxGb9tqD3PK4*tMK_jU)0Ig2^YO2>8*y|($040&lmmiiF6Pban zFiL_#LD84|7aS7F^e;en`@eecfBP=GK!j#Z>pRnx;=G6eK^rUd3;o&ViGJabs5wgUguV9q^fVHUvXC7Z_(D4jh}!Y83fN@6^bjX~ zq8E=w9e3?TO*W##O05TEAXi{Y?$r~t(l==|fR$THf7<#VXQ!i_eTMfQ87hJMK}pQ4 z5{UT$h_IK*C7S%aKjEcb;Bxw_CXHL@u161`rF49|{9QVp$e@wZFTjU$1&4r}kCwEu zD>Ah}-|U$C+iws{Wl9bt#E=GB_2&<)ot!%wVnp07qVT_-fs_G$lY|D^AEylWKK;VK zkns7;iI4&NDJ~`AL-GV#g08kY_^}CtSmISgNqKMtV1OVeX%IzL&k6&)nXkb>U(_fdAhH9aQK)I^a}g%7k0% z{@lJi;7DLd;7W*j*N|O2?>TjY)-XmG7jD#NB zzr%qfb0N&$WXM0T*&-sr>hqYeV`#Sx4YSPNLYk+b!O79U*lr2YyNPKM_5(&wwtYtQ zt< z2js3i#6<}RCchU7mmu08PcKUJ*u-Bn+>KVgMqb;}1F zw|hy7E405wSkYJYs7i(5f%xvGy5T|sic}$0qu3K}n`K!!)w^t1{xml?ng}x=l zFgD&&m6a>5IxMN%2j-20_LkGy@a>mILh3tR8cjv)2r2vlquC8PT8;O-%Q;%ApaBEi zO>2D*XY8_iSYa1EIY+s~PEbwC-wt>QX=*Wy&aIsiBzYqgGJ+b! zMH-87f%EOl$!x(6n~hBVT-WoH0(N%xom+cu+c3Fg(K{Cb!m9PpY22x5A3g9A$+YIQ zs=ZP8xIBn?b^s0ua@}*YnFZeh6C0PDpfhg^m;-!NkLethw?@?CAR0x+NFXIlzuuj! z5%_3;MjnYsd$rBu;QoY6U=v%6%w}1a`)k}?vk#-Ul@ST?rRqXS3km>*#?lZ4AeM?9 zhPUQ;m6mykswbv5N0)5vS+Cqzl{nXcoTeH%5 zaZ6wRa+hgZWELqpy6K;ZeM%PiM5|c!ab-a0)=?;^^i5^B9Dy*jLf?!+SVhI_(%~h~ zWZ-9jX4^N`Jvwzzz8_#n8XWHb?+0`7~CCU&u4e_Cj03SHZ+RN4Hei}Nft*xKgisA@G%(!gi#@Xpp$5WTt(2+)8~KJ z_!vU8kto4v3%5|paKcA*ZsFP|YJK~_Wb6RR(0Z$9d?!B$xA?mpJ}e)f+Z7?%Hl^|# zZt3c`O0JAL(V4dj4nTgMp~L#3re+>&!601++wTg``?&O2J$~F^G8o@rhH>Ezl1Olu z5D{c|^|w@Dg1zs~hl7CE&fx@pq_Z$t3T%$Fq+*ob?X)!Ga8Mk#I|aDxF9HAGBP#cl zkeJD+N8^HTr2*}&&lz!XrdntbslXg&6C9GI4Z$Pn$mRg-f!^CN*}qMD;l$+blkXq9 z;EHS zG>LNV_KD7?%h8RCf3N5U`S%j2p>1Nm4=U0lxCpoG+lDlTcSd>l!!Z-7;M}XXyT>#= zG#r$!5KO3aJ2#Rean}%oi?O~lv`WVBScw*s={`>{OF7R^xmQ-rtB8SLOr%55ZYgnQ z`cc?BYZh+dIKgZ+HqI^T*WfwWA2KNTIXSBM_ymGX&&-Dw==ruH$r;N-b5%LRGG|MA z1zM5X;i9wIT!QGE( zlKuG^b1rY&)7JKZ$?LPUqC%u|pfI%Ae(_Xf5Y|!RGgd9+NBxQ~JE?wbSx|J zEt>lfr}rFj0gLquv+7dk_4?{PRnI=jJr)6s5Z}$PbkjZQGB6HkYX2s;l>UO9zUlt0 zM|J*t_-^QohA7d)U|4R8lo(Eb*Q=%P^Q zKB=IEjyBxJ@1qjR>)>O=Nuk*yeuevQxD#iJkTTaXM{+@mlUr5{y&YK1#lbPwxwleTaN9-%n(z|%*+gN%#1O|%*@Qp%*@Oj zGcz+YjWaV;7MHkd%A<|Qq{5bo%mMPt#|s{ ztGJq!#ubNV_zEzr={X&Ei-BtkmmHfH>F1YdWVf*q$ej0X`_w8Hc41{RNtu@k=+&D* zcdz45EQr`*O~V>e6%Tqosc#he;jEEHM}F_9%AZ8<{1g{Mb4~v_8@CV%0w3G`fv>J= z?`Bu?mydn6u8eNXw(W_Gg^w;Po?>z5qO(+VZ?v(Dg@fzZ>QGoZl6NxmZu4AKnOue9 zAmta*boG_X*)>63#;beN*)Nj8?+4o&2839}5$*r8$Pyw`=bwtgb>nb?f4 zlMq}!47C`PmN!C8eSE(g_`P=XIozJC~9z+F~!@JFnh`b&` zE;cErHSO2udD^9nYIE>xtd1eyyJ}^LIZ=5xx{qbpjC*4@!t#!?!)K(wa{7UplB(e) ztORxZbOV|&y+5I5s!4vAvm0Rv&+b4u7G zA)4q<91OMrZ14&jy5s&bRL9_RMUOIbMJs|}brva&k5TaVCW^m^Pn|2|uy&s4gapq0 z!*275JB^}J!%&__b+&iyP-eN5`3);-mGI!{ zxt|z9rGC5#X~Vjp~JB`CVlMkin*X@(u>5YhmJL_^IC#`yE6+cGcM05>NIxA*f)q@EX7tSXX)xowJU(^$8$dC2b*x$_00tx+hqs%9A!t+t z0zl5ZjT-=R1cA+7NJ#hRg*J`fQl3SE`LgAmz%tTXp%qkbkl!-~;ztH9J1*RE zM&e%$YC{^~cW%$FEfQ`b^Pq~l*i6l)>t3?17kyR4hb03~s*6H}X#Hw!g8}f}pHDwf zBfN$rXyq+7Su2D!SV2SwMPtHKdD+7PK`(d>Ffk)t@EdS#qW>POKrN234{DGN_#9CX z<}RL=!0+|6MDPj0pTBAYqzK%n8@iK$YudQy6;_%iw%GnN@sGRzE#M7Z6cKldPb^akRx|Qi8Qmq7c2uC3KirB z5z~=d*TaW~&%%V|hxybdxyb!d!AV|;1Q-;cq=D`hBawpxS(G89wP6ErVH7+i#YUCBBT~$HpPz`JD1I~L@btsB`d?6}Lt2Q|5d4$NHfqa>Wwi#%FRW zF!d_c@38M6-kC6pqQc1ha-iZc^45KdVz4bVs}7QYDX2N8BfUIcL*6dYEXQ?YCaA!D z$~;7TO6ZV)f(uDdg2%XHN+OasFk)G&Q_-sx$Y6@N3swSGw3@Ukh2>BLuUcnfdJoG+(0om_05= z*^&4DnExty=v8rJh2O)mZ9^iDUA-NU-LvIwei+FNdD6pA=U~|9_ksmA&f@Mf3&Hy~ z>JQPAWEdMg%FSuf&oPlPW6RtvhOC#2-mN0PyV=Jreirt4l~UA23xrm97Vuv9r3H~5 zK4+w5&mIKSRLuFfPB?yqh{%ZG4Zaxi-jqxbC$~^@3-#V_ec~A8)gTAAhLo|GbVLqT zfpvt;gd1@%8uS@7T_ZDc;ej)$-fq8QPeeT%f764@NLT=GbnT~v!tW28HvL%IFdL-? zxzvg;D~YGQe3#VfNn6xFWn*~Q&RRZV3t=PQ>Iq3mId6daym0P*=6GYYg$D&U&Y6l& zRd6hiPRYY7O${8Unyj=jlAaAHxeQKgA3e7Ma}0!FHSB<@&_b3)zKH!sPl3e?!1o_r z#b6m}rAo;_w>PYMN~*!`GkH?yO&&&&sZu~RfDlEBx}=8Fr5#Q(xsd#MpXDBx8CJg0 z3?m5TK63Ee3sFW0Faw255UDUqdp5K-w0Bn!LNzn6hsy0`K0CSYMYCkE=vlA>;xYuX zmD)2&W#Q!w&VX_+AN(Uiv&R6-ekLGAUN@gR>6T;sSUA|tGxGT&(9WQbcMX*p2o8WH z?+e|=)jdD^O15WEGvbqU1Qdyh{AOYO0EkGK$WrqCDCG$9UV|NjUbFRPf|ThHd@gcw zzfgxp>{wAI=~9RS7_9ur_t|A^@FyFvJDek2PSYY>(Xijecf%{aP^9AZ2X+}ZQ8*;k ztL5&-v)JJ1Yx(X_>EVQ4=!1sCGSel7g;b{%vvF>?&GxSBXgk4re3c5rLK3P&V#q+kzZ z_7xp%#1o?T7r_If=*C16&X8GBN7fE&^cnsR+2 z7iv}b@#o`e1cAO$qS1RWhA#sm}GEP22JvHQ3X)e{zTGqawoG8!fY9?ve25~)UE zvwtRALdwvUhhQ~QY3{hneGc+MobZItMj-e^uQ8y1hK|c{yXn6?^`j7JzrO26KBLvM zfa)1c>6;*gw_!+QK?lPq890JvvJHpBJ0(iGu3eBWFbQ9uuiA4!A2KQD!ba(gkjY`c z8WNJzN8Ia4*f-GxvxiLSS2-mOj!0Ihv|9w7+CUt?9R*B!Hfo@Co;Lwu<_voJNxMM& zMPk#paa)f3PA(em!A){$FZ9@9WkS%e00qbKGed|36ZEEUH#G0{&#f&r(iAkDu_~vD zXI#A402wkB7ZR}EE^|0hRz_`+~LqP+N^KQz##HV9O zAQV2EpQsfGl3bjGB#C~r&TV=Jw#{f|3_p{u)FX>5#mdGa9wrEj{{W*gY46p%JLD(M zP!N{}2@Vh2SG6w=CsJonzv1vfcxZ>wcTEp6!YM?Hcd z$+P`N_oqt^IE7m+-ta{Y&UghWfOcesLJcBX?5R5J3C{~De_bw1dzOC&(VrzlV3pYq zl5hkE5CG@^bw`v-tW>Hjwr{;A0t0hWh`q*e1g+6bFx9<5zyqYv*wjaa@gz8zk<@0R zh&DDd$PU2)=optcHx6d|m+kWji>FLmk75zOd^NXQP|-&ipxk~WKOh@mI@3V_070V# zP2ka0WDK!NG5XhlU73E@8bx{Y2w`&xO-CGx*kqW({PifQ@oy$`h{ zwfjh-`PZu5e=6IBB|9igPu$iJdDIi;5j&5x=~ATrRJrwT+Ly zRn@qpCDl}WutglJL*Uz$3Vc{=O|?xA+|sgeZS+&v4KEy}4^W3&zJq)qQ`Da^HNJr(VF0 zceA&F`se$*{+#TK*xTFpWgg_U(mvp_q+|c*JvAU5(p|na88*Yg7?AzhB78^;BGTV4 z#BL$CbiHSm9vmd(`IN=?VzasmHt0)@ozODmUbfV-j;FoX3@YrDy@>FQBehf&oz(^s zcTE_0B}^LE@|t$f!Ru16kn)T$*pgfC=D3j^J9k?bbKN+sSnPjX4b3o;zacYbjsxzp2BuyOmXew zYU1Lg9IucFWO=5)uHWt^{uU{+Ug6xV#myMTVsR!tV{?T^g@`;#fmwK6MOqv!Z&qHq z55`;fua=(wo?52nNO}6h@z;3*CvQ4NnGS4dERwTX(7T?;?un$Z>CLY3qv343NRSbJ zX#o3YCc>T+teY=vVYvlDJh}t+aZcP?Nt?6Q`k$WMI_YZ`F7}Df=9XSZz2}A1v z$plsr&+MMz*(x_Z&T3SZ#EY8*5vXs}1{MGsh)m6hTy`*~*iV->XQbxA(Uo2I2Fw#S zHL#f}$P7V>oFF<_Q2^!QEqJ+SgxIEYcztlisV|THDV}h`YJ2*A4NlS3waj#*m5lxx zjO-(P&sDF+H+t&My_Q%_vQl+?4(>S!@mamM|Pj+i%){S&eQfq`BfoNmhPRi{yWA&?@+TAMygH9!**by6qv3T zV<};q((!a$uXO_Q*v_bANOq`>)||EBQbOjzv#1DG3(2VKQX=DiGz#PNkvUk%%@#69 zD5gfKF^~z^c|TZ?El5ii%wh(g&QdJ@rd3q2EPb@>YsO2*3tt$yU?sfvOpIf@y+mg% zTCMKn8?Wu)(chGw<$ zvRi#Wj(FGpEnW=_Wk^5y@{@-@;yVSv2P_AvZA0=$#<4?PM|Sq=t&hJ|e~FBN zpcz!qwtP`vU!M!%>7u?1VURJmtS<*Scrd@QZP+Z!vE*jiww@l7(L+(d2!Y42!cT1w z6xn!g1H3VopB(KPTKkP6m|E{{k_Cf9TnYr}al(y{ed3O7t0&;8tU0y{8*{JQshFOF z8HKFr=mYPvwDcVqB)t#Mxxib7Ls~5?*Q?>0&Zx}Mjwr)rd3Z=PhLVsYE4K5jrOeyY zv(>^K=^Tcd*qtx4-V`#SC}RiU5TeaO;{9W7)XI}l%REDfhl8c~8Ry1kra0rfR5((O z@ncME_7Ol+DOZu;AU5-XhxDse)2lRC@vodOmE7taTd{T!mN&~yLyw63!C5n~7Mfd{ z6|F;d%h5#Qu2AJ*>S+sTs}XbdMFM`7VvhK_Ur(TX9Hue|tlX|9tb1mvnQ~aOM>p!q zT{>z;Ye-(_NUb?KQbfXmSdbp| z)~we1-(BbZ3Ox6A8W2dN%*ABHTQPymC~kcHd4z-#?oaKvg-m8n_clXmFl(hueAf#g zN{EKdL`M6SzElZZj_F=Hmz9OyWoHd~K+P`&x(@}%U%po;unrEv`($PRsAb^Q8Cu<4 zobQQ3Z7LuA^(`9OVpbQqSDSnNcFvqDZc6euf^^$nMSJP~;=ExqahAh5zavXo(kfJN zVHZ}Q$9HtHdE((-sY7k|@%x26fRpMBBG2svwTjD%BzGvgrB+4{Rd$}1Rz!Tf!G8Y| zm2yYA&7qe4!V~NCieO$AzX=!o# zb)xU?Z>6W7bzVCg$XK)=j6O4U8AY}p>zzMtycO|si&*nCcHg?!3WPGNmz4``k*^yq z-f~knzHI)+Zt(wxm3|?4GMg?*C=SB(B=?nIpzA6ThP`^F{Rg#8jid3+LtubBhzTTS zH~Mt~Y0(2nxh_l3D@$#>(T47$hTdOI_DRko~)h_f3yy;^l-=FVMm;AI4F{27JNU7P*1wv(r>coiI}jnZoXzr|4aj2 z{ds7XuO=4mx_YgcBA-;UDK5-c`n(vLCs&&rzrPI?ZyO1 zIm0my3pS=!TUhjmtuD#IPN(K}Z*al64*OPZ6#<(p54sv~FKP}+$00sR?`0hD7`w;S zw%?IS6@G|sL|&i0F@%}f5?AY3DakFu(BQHPq@W0B&kjJ76_ndUTfGcZcad$p&8j`fD%z;J3!S> zWAE}X@iYrpt)(@<2>JiF|k^7BqhK5I;p9>zN+`JKEcVjRio9V zCABq2S4bHatCd+pgaNPqy%(dyn6Xw~GVmu^Z;9fu4zF}n#22fy zSu4ucB{cm^W_nR$#bR|?0hYcB;o)MWJIHudLzMfiKbT$VPjW@g#KNkcjD-_=AMOnf zJzB1vqCHwvT}fw}7>-<2Uk|53Dykye5~rb`#4k5?6cX6G(aTv-ydo{=?f8vJgz}3wJ)@zp;>TfOpBWF}ku`9yf+*wo{vRoP2zIahqTMgVN)oev-9&^B( za~sL+!FwQea~I7p(&2s*Jigkc9+bDZg&Bd!5R$x>pOqsJ5V)8&|LV#0lE1KLJ0`{2 zms0I^?bjh|-ZRrP(f8&&*?dlaIpg4pG^LiYi|;D4jQ7b4iyS(q;8a|CIU`x8XHs1#+O0$#MWTre0Y%gal}~A{G7?t`0E$!MNyxMqVykHZtP}fGe+hxXOBbt zvrz9z0`NNSLgK}#Z9PVK`x(vhql#XFP1PMwao6s zI$4QAE%!^`-rR&*)KjuTwylq?G~1nCe!l*WG&zxwg6h4gdf88!=yCT2jtkE9F2vFf zOOQ0jcfr}oOoaRetz~ZMzZ2K3>~~w-4Jx zBl%Jbge`2(=decY**O?LS1VZlebuF*uCsTlzzMCn2CaYyZ8t%ap4$X+PcAZ+)pO7! zVVgGndHkNBp%dgg1NWC+&(xYl^RwU9S9%`l2zOk><&|ktAW4)FYO6zHU1e3LlB47F zYR{u-H=3X0h!;Oe-k{8Ac@u4>!0b~FtskA%Ct$V(im{f571wt-GVpKY4u=_S9xcCg z*nVTqXIDZCj4a?-qwG%U%y~e$tCY4NlS4yFSmH`oA}~;VkTB)Wjal6w3g%#IfOt|s zx6&rHyXS>Y7}f}g5OW@rARf$|yVHYjYM9(vW?2Da2tUC}rH1ks7{C|i;X2eT%a)jW z!gHji-ELLg@4U5TBkLCLSwxGjG8u9J3IZE~PVw@AGz~3jLk8y(g&P*x&U3n}k9Xw@ z6K!y|vsU;=g0n?5g9fbuDKtO->Th-SF%D=q*Nq2DVH61a%T2WE0o$L)T<>my5f| z;=Og(kvz$muU7{tS?B#3)vJ3xd2^p}x*&(^_~=2QeO7LM-dp6or&OKpUteV4snvDA z&Fc}`q2!2#SPCLVgxva=;qENTDYX13-|RkFHI8L+RoRuorMRHra^@k%5`RD0l4-fk z2}SbpVJA{W*Fz>L9xFR=wl0d{u_Z4F)Hd_`>?Qi{ zhcOjc^F1=vH=MD-EWkrp7aum=QpptP`b?8N&o7!7rtx4}EP8w27R6xop!hG_ZG_Jk%pC9T4xh0e9Q?w3U0}oqn|gNmKI<;}UaTa)B~bD?BfRwO zW47rl-&2xOZ|5?N^AXwlp!n$O>`dtDvMB86mAHTR%QB;Am_J9emNV+EXmG_1csA}X zl+&~|sDe<^q*;LaiG&bix0R-wsVGh^K6xsS`+oWyU{%!ui^NUCej>i)j!W;WUBAU3 zm9@{(C_bohbrttK+1@$$v@MzeILxK#^3*=t8G(;~{dOn0a1uYA&#dh`a zrx0zZQMv+g+&;Gugwq8{*y6C;FVo@XOTalhJ{Fo>FFPY*yAeb<-T`1PxN+Xy4_|ho zl|WOOM2oCB@&!~n)OV4c&2`pd(pnqHPh48_rO2wT&xXVy*|*R;Wpfjsx1o=%A8ucT zxWwht%nJouR&!j(oFhfg8RT_z8DJ%{%@f6=Zrx#yUOg0*(VBkJDWYdG)hFJ`$g-LR@txwa( z#+En;QVq?wp}`oH+ijq)XWhJ*{Z3#!*{~`=pc>`3rtCqC=T4p};==lp)4vLUD2XXa zs${T+G8tKZ*9_7jdk}vwx!2lE@4;h6DVUjYYZs*zM0ygtOS{Suh?T22;YccHX$F7W z=8$%w-`La2M1{#miE4L7Z>@d?CS^LzQ^$f6Bo1s=xJHbxowlf7h>LxDX|T< zX}Vbr_+2-M(HPLrmn&Ha0+8=FNUDMOKACUs5mZRSCq9%yCCbPFE9@1MVaik$?6ej; z`DOqFg?Kh|P-zrT@S<$RzQ9ujs?|YkhX)@z=b}7~=X(X)=l>uk*|CqJF75^P3K;9S?)_72%j>zFIw3;94cYR_JIgSunQgP2lLXTQZamyxDgPdbu& zFSZVFH0q7Mr*~)?5DKjr@0&sqfh5)iyafFg+?#@`gwh(gC0f^X(+vNqM|ofh9h+G; z1k%xmsW)to=d=Y_hg|Ty!Y_%D6Y7tV0$3;;dp6)0R#yCY0tgBUA|DKTE?0Eq(VbOWGm$Vu8G* zzBw_fP5ia(*JCRSDv9FcdTsFr^e1nfYQn8VKxcM-z3M~)o;*WZ45Q(v!{N3y{B2$M z$3f$EJAU^vc3Yv^ZPbGM#S?-Qd6+~~u*NAnjnAMK!d@P^UYt4H6OmM>xTI=n_DsZl zebV1Cy(;-r!$StIV6mbe)f`wlVo2s9*E90%0x^9 z34$kxo;morEB|Y?Nu#|AqA7Fo{w})8anGFx!)mAG4{^cS; zi*|};=~ra~Q2I{bBRmGWAs0`4_9K+QW_7d_?`?({7w312L^CG9<6eT)=+!TQ1zV{a z;VwLcso>$-MPwxum5dnfSAzu7SSICYJ2t0B#>4&)(J5}bF0Z%#O-KxNC+8*R;DDgG zeiok)!TKT`Ghz{g;nlccWD{h z?T;~&wDyycxM+O>(>DkPW|xhQ75}V9)y){>jA+rzZZtyi)58faO}h(pQ8Tnky;K z_6qd(*paHS2)Wv#v+s|i{RBTmmxY!bIA)uGf^$i}XIlZ&n` zBoxQRC%=%dr7TX3h=l{f8Z;w_dJ!FJ_b74Yl_3;G3sg(e4z%FoStKXdXbB`$z#ixo zhWZ)!>l_o&9OW!SDXxwbRUz?^C3M!{ zcDMRn!YiIB=YUnMona7S!ticoHc({rngCs44FU`OF* z(AzKVz6env1#B$&1cZhU&+(Qp4bkjp4l0| zymTh%IF4$#-B0%@bOVC~nHGr6MC1!?_MufX_c1fZ3_XPNsgU%x_$WmN3`+-3Ue4;+ zNgM?Ub?Sw)Rpc$Ooa8G4Ke4x*9(fEEdo$)!O{h0kdg~^`ZIvr>ejSgchP>i^ z5~z;P%`suzr;{oZI~j3V*Cs$O8u7`MC8_SodCX~^)(wXKSg4FDZhz3Sv7?Kwf`qJS!f>cb{Q+)NE!Ulo z<$AIildbm@i|E%ix+vO#f#g2%IWEf&#&GQrN`2nsH#w;Wu>B=P>8wzF;|W=DIE z3)&`n0q_aCdrInGH|o2!Ii74!e6`d@0zT7)eN8_wd#s|kArf|YNrmYSV1l(m(t{mE-=xU@|>w*wwRLGWo+9n5?Sn(?>M_9l&yk|WNbUi*%$t?5noGW?B z$>Z|iz8=RK5l>XEnif-POLPVa&&al?`bv>r*mwkC1@qMq_N_(o<&+T?1qjrvJY%de ziKPj0@x@ncWcLDBma6vKsj=8-CZjG{Z_2j#Bz9Oq8fjf}g9;ay)CdYIjgGDz{*CAC zd#2}}^WoT!Jc8+p><)cEW;guc9Skj`#INiCR5afMY=2M_yU_=1P_a)W?JCS-L^&~K zAtNjzIqisRc^2PEo~4PHmE9dSveed-Z8jew?v&%fCK(Xt48TASwz# z!r6Lbn`O%09&TC=B;Ss+@JvWd(X1GhZy+3c)HOihS(tYO6)WJSHlX3<_wNmk$Mu@G zU@~8|Ryel{3x@wZ1<3a`IXSM1a3p*(?0dD zm>$7ng0+myPG-*M2zf@-Ht-rZ;2d3V+tSoXZH+cZxH)a#6hQT~^%U!y$JPWH zhG-%TO}8%M95c8f0nj_6+!zlFRpnaowz=Jum@@;f;jr67R`1`v3DBC`5;T86m3~Xg zzX2zSu~Q*Ky`zwLJs|MB*pva&6C=nO`U*G6W02zfYrE|T-RH&foR^ib(w4Kw(a0U6 z4qL8eEu8CKXO$iIXrrFQ$90n4%n}!tRCJu=Dtk0FTSKoOK9Woo zt#lg`y)}Gg^Fs4oPQ3Vu4h#Xn>;HcLg%^a+xhI{k_XU}xOY0mC@rOAOmJ&h}UNaBm zFxa62gt372&be;JMRFv@;-$>y?X780j%V*PEG`)59!R28%F`Nm3UvpSYmF48gP^06 zvlyU(W+lKTi<_4_r*7bKS_^*U#og1&;Gk}Za!Lu4UJdN1=WI|tUPfLq;zaTrIat&z zf-_3+t2`MFb~0^Ia4(Lq9mt(oz_ew%>-PHWO4-sLf=tgQ?XJj8ZN7pyD_6KtBvreS zyh9wE^|M%tfuf;nW1iyfGg-3n%?jfFXF!m!8zec*;$wIfSRfIktd68;&{r<|z|Sp2 zhl7U%DTO<-Y&>1J*;PBWz6YwOp4=-5TbK`5n#&@#o-uArw6pZD*7>^(BH_nm+qn%H z<*7J|xDeZQ&x>QB@D>s{WAMwh+tjoWhPd+?G%;SkhIyw?|Tqb z=O-Sf-$>Vvzj-`Gf1p!trScKvjE7R|eupdOsC(twad=Sf$;nBDghO3fQKk2Qvk3>sVw^2z!!8gy zInUC-ykS9@zH1`NVf-wMq}>@QD^XlVva7PDiD=V=*^2pNks2QL$6<_H&tZJkV#4G4 zcFU$!sF~@YOG19?0CTiT-}G_ee$zcBbb@7HI^00BO(xLub7;g{2wg983^_IQQ+Hzl zmyy@+Orhk+u{SS%Vn)(diioc&Ooh|lZApZL_qn_K>2q9ksKSsV01El1N3)03!=~9u z5Xv09?5m+QWzH7DcsnH=F5a;<`Dz;G zN6+HriOd5b577=Wone+IwR6^e@pgX*)N@1*ra)iT(bIG!_c8EKJ<0VK1IO;)Zju4i zFx1G@MLJi0gkLZ)MB1*`hq4>2Su^CDpyVA+gb1}w=amV)kN9dsJ+!v!!qP(rT-iB> zE*1%wn>XEzs1mm-t#&7j!di>4oTl7aV==X)$gA2X0E&2*Ua{x*$S|fkzF8Cw2RJ|b z{g<*Z=+eI7(WPeSM3MmykEFQPZpYXI^BGi2he8wAhPOq?$#&}Cdw2__DDdGG>do)O z$j@lSA!@6UrrawImCL;eodT92&iIsHzbTscOc;4b5#rZ9B-ILux_kz&v!j{J`;C{y zDHxJ`=(DN}Cql*z|2`Z-!PPtFky7L$W`<*|kcsjIHR%pqQW6SfKm_dzmfUwsonaqj zuUK*7W19`F5*F=XR`K!+-R!y5+3UxWj%EE?fci@rrnZ5#_E&%*;xwRqGUK^XSe99J zn3z*vAe)sCc2k`3;hjLh$uWFcD6WB(a}?FnLrOwJt4zI*dF%b7RSF6kYv3!w!AG9K zr~i@Dh4_D3r!4Jk^gf_jIySa?s|q9HJ+i>GR#Wj1{mpJa{zJVyx2d|a4gNkMhy?y1 zx&`eRe_}KUK8W|OyfErH)r2>MyCHSqqDHK@d#DswnBk{k@H3EV(v23I9UzkX3pkn`5Q~dj zEY>H@V`_!u;5!Zy4qutnNQj`~d6ykC5HJt^V*9|0XeF|Ks!Vs_}z}^q;L1 zg#X>?Z!jSKzc~4Sz?=SCr@uIk|L*q3;N!deZ~cJ@{v*B*cGG`F3;s{r|3L}^Cz-h~UH~?Vm^yl6G0(UOA A_W%F@ literal 0 HcmV?d00001 diff --git a/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java b/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java index cb9e2e86..be356342 100644 --- a/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java +++ b/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java @@ -120,7 +120,7 @@ public class ZipRODirectory extends AbstractDirectory { ZipEntry entry = entries.nextElement(); String name = entry.getName(); - if (name.equals(getPath()) || ! name.startsWith(getPath())) { + if (name.equals(getPath()) || ! name.startsWith(getPath()) || name.contains(".." + separator)) { continue; } From dd7b397ae5ffbd9f783f5ae0ee304c4b28916f2f Mon Sep 17 00:00:00 2001 From: Connor Tumbleson Date: Tue, 19 Sep 2017 14:40:25 -0400 Subject: [PATCH 2/2] Remove redundant check --- brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java b/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java index be356342..9b9522cb 100644 --- a/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java +++ b/brut.j.dir/src/main/java/brut/directory/ZipRODirectory.java @@ -136,8 +136,7 @@ public class ZipRODirectory extends AbstractDirectory { subname = subname.substring(0, pos); } - boolean pointsToParentDirectory = (subname.equals("..") && prefixLen == 0); - if (! mDirs.containsKey(subname) && ! pointsToParentDirectory) { + if (! mDirs.containsKey(subname)) { AbstractDirectory dir = new ZipRODirectory(getZipFile(), getPath() + subname + separator); mDirs.put(subname, dir); }