From 0ca6fab31f0030ce0149ec67e9b759246ba2dd4caa80276a4f75946e7c0a45ef Mon Sep 17 00:00:00 2001 From: OBS User buildservice-autocommit Date: Wed, 25 Oct 2017 16:00:50 +0000 Subject: [PATCH 1/2] Updating link to change in openSUSE:Factory/wget revision 49.0 OBS-URL: https://build.opensuse.org/package/show/network:utilities/wget?expand=0&rev=67ab3e42ff8956d7492283b54cdad5f8 --- ...on-negative-chunksize-CVE-2017-13089.patch | 31 ----------------- ...on-negative-chunksize-CVE-2017-13090.patch | 34 ------------------- wget.changes | 9 ----- wget.spec | 4 --- 4 files changed, 78 deletions(-) delete mode 100644 wget-stack-overflow-on-negative-chunksize-CVE-2017-13089.patch delete mode 100644 wget-stack-overflow-on-negative-chunksize-CVE-2017-13090.patch diff --git a/wget-stack-overflow-on-negative-chunksize-CVE-2017-13089.patch b/wget-stack-overflow-on-negative-chunksize-CVE-2017-13089.patch deleted file mode 100644 index e6206b2..0000000 --- a/wget-stack-overflow-on-negative-chunksize-CVE-2017-13089.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 3dbc2e06ad487862c2fcc64d4891ff8aeb254bad Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Tim=20R=C3=BChsen?= -Date: Fri, 20 Oct 2017 10:59:38 +0200 -Subject: [PATCH 1/2] Fix stack overflow in HTTP protocol handling - (CVE-2017-13089) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -* src/http.c (skip_short_body): Return error on negative chunk size - -Reported-by: Antti Levomäki, Christian Jalio, Joonas Pihlaja from Forcepoint -Reported-by: Juhani Eronen from Finnish National Cyber Security Centre ---- - src/http.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/src/http.c b/src/http.c -index 55367688..dc318231 100644 ---- a/src/http.c -+++ b/src/http.c -@@ -973,6 +973,9 @@ skip_short_body (int fd, wgint contlen, bool chunked) - remaining_chunk_size = strtol (line, &endl, 16); - xfree (line); - -+ if (remaining_chunk_size < 0) -+ return false; -+ - if (remaining_chunk_size == 0) - { - line = fd_read_line (fd); diff --git a/wget-stack-overflow-on-negative-chunksize-CVE-2017-13090.patch b/wget-stack-overflow-on-negative-chunksize-CVE-2017-13090.patch deleted file mode 100644 index 4017545..0000000 --- a/wget-stack-overflow-on-negative-chunksize-CVE-2017-13090.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 28925c37b72867c0819799c6f35caf9439080f83 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Tim=20R=C3=BChsen?= -Date: Fri, 20 Oct 2017 15:15:47 +0200 -Subject: [PATCH 2/2] Fix heap overflow in HTTP protocol handling - (CVE-2017-13090) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -* src/retr.c (fd_read_body): Stop processing on negative chunk size - -Reported-by: Antti Levomäki, Christian Jalio, Joonas Pihlaja from Forcepoint -Reported-by: Juhani Eronen from Finnish National Cyber Security Centre ---- - src/retr.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/src/retr.c b/src/retr.c -index a27d58af..723ac725 100644 ---- a/src/retr.c -+++ b/src/retr.c -@@ -378,6 +378,12 @@ fd_read_body (const char *downloaded_filename, int fd, FILE *out, wgint toread, - remaining_chunk_size = strtol (line, &endl, 16); - xfree (line); - -+ if (remaining_chunk_size < 0) -+ { -+ ret = -1; -+ break; -+ } -+ - if (remaining_chunk_size == 0) - { - ret = 0; diff --git a/wget.changes b/wget.changes index 51071ac..5175d3b 100644 --- a/wget.changes +++ b/wget.changes @@ -1,12 +1,3 @@ -------------------------------------------------------------------- -Tue Oct 24 07:07:32 UTC 2017 - josef.moellers@suse.com - -- Fixed two stack overflow vulnerabilities if a chunksize is - negative. - [bsc#1064715,wget-stack-overflow-on-negative-chunksize-CVE-2017-13089.patch, - bsc#1064716,wget-stack-overflow-on-negative-chunksize-CVE-2017-13090.patch, - CVE-2017-13089,CVE-2017-13090] - ------------------------------------------------------------------- Thu Sep 21 06:45:00 UTC 2017 - josef.moellers@suse.com diff --git a/wget.spec b/wget.spec index a8d084f..8ae3839 100644 --- a/wget.spec +++ b/wget.spec @@ -35,8 +35,6 @@ Patch7: wget-fix-pod-syntax.diff Patch8: wget-errno-clobber.patch Patch9: wget-CVE-2017-6508.patch Patch10: wget-416-but-file-not-complete.patch -Patch11: wget-stack-overflow-on-negative-chunksize-CVE-2017-13089.patch -Patch12: wget-stack-overflow-on-negative-chunksize-CVE-2017-13090.patch BuildRequires: automake BuildRequires: gpgme-devel >= 0.4.2 BuildRequires: libcares-devel @@ -85,8 +83,6 @@ This can be done in script files or via the command line. %patch8 -p1 %patch9 -p1 %patch10 -p1 -%patch11 -p1 -%patch12 -p1 %build %if 0%{?suse_version} > 1110 From dfdc30c146a9cb1ef70e0b5079b208f0cda9f6c775e014c8fd24f698cb76e930 Mon Sep 17 00:00:00 2001 From: Andreas Stieger Date: Fri, 27 Oct 2017 16:40:25 +0000 Subject: [PATCH 2/2] Accepting request 537218 from home:AndreasStieger:branches:network:utilities GNU wget 1.19.2 * CVE-2017-13089: Stack overflow in HTTP protocol handling (bsc#1064715) * CVE-2017-13090: Heap overflow in HTTP protocol handling (bsc#1064716) OBS-URL: https://build.opensuse.org/request/show/537218 OBS-URL: https://build.opensuse.org/package/show/network:utilities/wget?expand=0&rev=82 --- wget-1.19.1.tar.xz | 3 --- wget-1.19.1.tar.xz.sig | Bin 566 -> 0 bytes wget-1.19.2.tar.gz | 3 +++ wget-1.19.2.tar.gz.sig | Bin 0 -> 566 bytes wget-416-but-file-not-complete.patch | 21 --------------------- wget-CVE-2017-6508.patch | 22 ---------------------- wget-errno-clobber.patch | 12 ++++++------ wget.changes | 19 +++++++++++++++++++ wget.keyring | Bin 13801 -> 17910 bytes wget.spec | 12 ++++-------- 10 files changed, 32 insertions(+), 60 deletions(-) delete mode 100644 wget-1.19.1.tar.xz delete mode 100644 wget-1.19.1.tar.xz.sig create mode 100644 wget-1.19.2.tar.gz create mode 100644 wget-1.19.2.tar.gz.sig delete mode 100644 wget-416-but-file-not-complete.patch delete mode 100644 wget-CVE-2017-6508.patch diff --git a/wget-1.19.1.tar.xz b/wget-1.19.1.tar.xz deleted file mode 100644 index 6a1b38f..0000000 --- a/wget-1.19.1.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:0c950b9671881222a4d385b013c9604e98a8025d1988529dfca0e93617744cd2 -size 2111756 diff --git a/wget-1.19.1.tar.xz.sig b/wget-1.19.1.tar.xz.sig deleted file mode 100644 index 43a33c8826fa18bf7743893fa5ac5c8176cc5a2ab35138e0beec06bbc54739b1..0000000000000000000000000000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 566 zcmV-60?GY}0y6{v0SW*e79j*2vVFXmVM{GoL1b+RFfF#CX9Oq(0$87Wr~nEH5C||W zwxVYQD4r`20EkATt#6I00g_^3$28QD!Y)AKwAs}1+ox8|KZ|_}2&7F}OoS|KSbEYa z%v<8=bT!W`Py!lO{^>E(@(Xcw*x$0`8oT0ZJ-U%^p}lay{Oh5q@B?>nL?DkSnMo2j z^z$A4X|jV`qJ0{LcR3#E;uEK(eLRdK1?J3|$0rA>S7$oR?RC zV@@{TeP?QSjM#Nya0d%)Wv%y)Z1`_G(JBn(%f_Dh1h+ZmKq6rqBq4jL046;s_}jBv z6%|3+J|#4iHNlmRjA?SBY4whuMtdJpMldPTDU`I)EMP#C)vm^@3zs#UeX>-KJ6V}T zjQp%sj=~6_J!$OV2;5MT;@FK7zg_KixhxAosO;q;UPz7Hg#O7l&VRAb*-gfzCp7nQ zKiUE#z9Max?AD;v06TDR3#k~<)=wij_jK#4){Z1L$=em`A0@ zLq@pZjWvYYD@8*qQlpU@c??jJo+Td}yZqIJNi5jph79n|`mem{baajcUXZD2k&o&dv%Gv@r^ z1{p;z5jN{uJ7PTaXubQ!JANV~OXd56?x{H^^&MOZp^eE9fF=> z6pIJQlt9YCXj%Bw8_Qksr`JliQA4X#+#wSF-&6hV;@_(U0-fc~;pC>YL|?%j`Tedl z%6WD@hnSzDE@aX2A+>*N4!_P_W)_K)2oDXx(L7swE0%1eqE9pZ*vuh-e#77Uix-?A zvY%(X0@lfUPy`{sK! zXNzc1s4$JgR;c+bxxD}Pxf0c^IW$T~DDU88nuAzf9eJkAM-{Kxxs7Y~Z~9O~(5ka} E!p+PcjQ{`u literal 0 HcmV?d00001 diff --git a/wget-416-but-file-not-complete.patch b/wget-416-but-file-not-complete.patch deleted file mode 100644 index 63bec7c..0000000 --- a/wget-416-but-file-not-complete.patch +++ /dev/null @@ -1,21 +0,0 @@ -Index: wget-1.19.1/src/http.c -=================================================================== ---- wget-1.19.1.orig/src/http.c -+++ wget-1.19.1/src/http.c -@@ -3819,6 +3819,16 @@ gethttp (const struct url *u, struct url - } - - if (statcode == HTTP_STATUS_RANGE_NOT_SATISFIABLE -+ && hs->restval < (contlen + contrange)) -+ { -+ /* The file was not completely downloaded, -+ yet the server claims the range is invalid. -+ Bail out. */ -+ CLOSE_INVALIDATE (sock); -+ retval = RANGEERR; -+ goto cleanup; -+ } -+ if (statcode == HTTP_STATUS_RANGE_NOT_SATISFIABLE - || (!opt.timestamping && hs->restval > 0 && statcode == HTTP_STATUS_OK - && contrange == 0 && contlen >= 0 && hs->restval >= contlen)) - { diff --git a/wget-CVE-2017-6508.patch b/wget-CVE-2017-6508.patch deleted file mode 100644 index d3b0c29..0000000 --- a/wget-CVE-2017-6508.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff --git a/src/url.c b/src/url.c -index 8f8ff0b..7d36b27 100644 ---- a/src/url.c -+++ b/src/url.c -@@ -925,6 +925,17 @@ url_parse (const char *url, int *error, struct iri *iri, bool percent_encode) - url_unescape (u->host); - host_modified = true; - -+ /* check for invalid control characters in host name */ -+ for (p = u->host; *p; p++) -+ { -+ if (c_iscntrl(*p)) -+ { -+ url_free(u); -+ error_code = PE_INVALID_HOST_NAME; -+ goto error; -+ } -+ } -+ - /* Apply IDNA regardless of iri->utf8_encode status */ - if (opt.enable_iri && iri) - { diff --git a/wget-errno-clobber.patch b/wget-errno-clobber.patch index be2477e..75a0b76 100644 --- a/wget-errno-clobber.patch +++ b/wget-errno-clobber.patch @@ -1,8 +1,8 @@ -Index: wget-1.18/src/http.c +Index: wget-1.19.2/src/http.c =================================================================== ---- wget-1.18.orig/src/http.c -+++ wget-1.18/src/http.c -@@ -1516,6 +1516,7 @@ persistent_available_p (const char *host +--- wget-1.19.2.orig/src/http.c 2017-10-26 17:30:08.000000000 +0200 ++++ wget-1.19.2/src/http.c 2017-10-27 17:59:48.659093393 +0200 +@@ -1524,6 +1524,7 @@ persistent_available_p (const char *host active, registered connection". */ #define CLOSE_FINISH(fd) do { \ @@ -10,7 +10,7 @@ Index: wget-1.18/src/http.c if (!keep_alive) \ { \ if (pconn_active && (fd) == pconn.socket) \ -@@ -1524,14 +1525,17 @@ persistent_available_p (const char *host +@@ -1532,14 +1533,17 @@ persistent_available_p (const char *host fd_close (fd); \ fd = -1; \ } \ @@ -27,4 +27,4 @@ Index: wget-1.18/src/http.c + errno = errno_sav; \ } while (0) - struct http_stat + typedef enum diff --git a/wget.changes b/wget.changes index 5175d3b..6510c52 100644 --- a/wget.changes +++ b/wget.changes @@ -1,3 +1,22 @@ +------------------------------------------------------------------- +Fri Oct 27 16:05:55 UTC 2017 - astieger@suse.com + +- GNU wget 1.19.2: + * CVE-2017-13089: Stack overflow in HTTP protocol handling (bsc#1064715) + * CVE-2017-13090: Heap overflow in HTTP protocol handling (bsc#1064716) + * New option --compression for gzip Content-Encoding + * New option --[no]-netrc to control .netrc parsing + * Added GNU extensions to .netrc parsing + * Improved IDNA 2003 compatibility + * Fix VPATH issues + * Improved and extended the test suite + * Support Wayback Machine's X-Archive-Orig-last-modified + * Several bug fixes +- drop upstreamed patches: + * wget-CVE-2017-6508.patch + * wget-416-but-file-not-complete.patch +- unfuzz wget-errno-clobber.patch + ------------------------------------------------------------------- Thu Sep 21 06:45:00 UTC 2017 - josef.moellers@suse.com diff --git a/wget.keyring b/wget.keyring index 833408621ef7a633e27f144d8ef59828b9f7f254cc706c8d86d570a28b62eade..63407221922d5a05010519f0434f390dff45dccaa284e16c7d1a6e9a3dfd410b 100644 GIT binary patch literal 17910 zcmcJ%$FAJknkG0Gpm(^#ZUj2%gJc0Yp!eQ$M$e#kK?dXLd+l>>UYC`~ssc(I8<4Q2 z0L^bcxAg1(`}xHRl4AbFmh8XS0jn$AUo;{43#(h4_Q#KZ{|c*Zf6deX_=_~XZRsy3 z@^9$B;eYvmBr|~Y*Yy7UzrTO|{xv$%ixspw#0r;XxQ>DAT0+(pi4KoP(aT=ACxge6 zr9zv+IR*=Hr+*?Eie&K2ydJ-QwV1$94A1Cf9UcPL<1}w^sM0B?deS51VtucppR9yl zcg%|)(Ll|H{Fnw-aHOlt-S1!7x;ut77((crg=^*fTYMmGkA9W>&8(*E6v5(uPAkKo zq#sxFny7ZsBbs(`O_zP=-@p2)$+dYHA8!Lv9zw>x-^HvJJcRfY^)cPj9}h^|ybL=N zLo&J#O(SRbU_@c@a)^|E|1xCVD-fkYt*1r{@dJXymvB62pFNcLNtzq|wDo==s55=T zYZQMR+ul^Oj|iF)<^uoyi}p;ndYcGAWl%w1j82SX&pfiI4{-Tg%zS2JgJMy8lc{jq zq^_6bm?w8{IqoN!MSuT_vy@;U`q>j$PD6W3yJr9CO1VnW#9K)vb^PuAUP;Q`yilaM z_dc-pevgaVZpRcZzkgA1-^_E$A!lxkNgRvS0yN%vwkBE{uRxn;LpV< z-ib%-SwtYee^nf@l>AeP8^;$Mg^`MNNRJuw zGefg5befMff4_queIc7Y$Jdsr9hSWfM`+RehC6b9y1#z~x9ckA&G!YVX3teglC%%M zQM1-rNm$=IEf?~YLLpPG(|O3!vR15W8FsNbZCG!hnCx3Oq1CT9cazmAF|PV#Km|TA zZ#Iy!2*nh`qgLOiginjWmXqUGkjYJqp$zA6BD}CHX8JAOaqHjd! zW6p5m_!#fLdiEi~8jxTl`sq-o1ViYOO`t7Xjbq_*g@$m|sq@69W+B#QZ5*@uf8iulU)~VY#a#lX1Kk>A|gv z7ohV}Q9sIfidVG=GMy9KN!s9Eul16{tCvk-DU4cso*gfY#jg(L8hisU+8* zO{e^GvkAX{fp$}v%ZZrAV3`&N-xb5OJlRL-byGK+|iz&;|F!E=0`inF_qF7Y&Zb6)>=2S3*j?&3f0 z0CT?y%-$(z+cUFDd9XBsDDnucfDg!}!Axdcvb1Wv>m zkpZj8kQ;_;dPhYnrp$u1GY-&WTxC5|HJwgVmtCyT+AJPLc*^zT_pjF*+!ymAI z7K82Ri0PS{P7D_&IExQ1^h+s3(+JGYe|XXg|M@0p3kF;=4pSPdOoFj({vys|EFLe3 z5rmJxG2lzO42ipXg}n@pWdn|53_%1{^B;rm_pgQtIM3NH@CLxhW2O*ik;Pk$`#Ld3 zr2~!jpWn%xE;bxq)+>HkmV8a?RyN?yq&Mj9r>t41^~SH8qTf%wdp3_kEm2q2aS^#QL@P9(`{LV94ctixr>J+OSMO9Cd0{K$Ee`%~c?Li-JH{Dqwmf~~H@(KFgqdaW*A(vL8 zOs@bHgX4=9$#Rd^xx%WchmlXy6b$a-b0V$R*CJu_PET`E@?Z<2C!1aZqh7WOUJV=N zm8UD3BAdgH=p1o(GJ8%n%t{a5=0s!6HzgW-t+rsEtvJAQn<@90EPelY1h`6?i5zr} z|2^Jrw_a4OnCl?nolAbc_~-YpS?^6RPMEXJC_z+-va{=$7&qyy?~gZL9(#o3dI^Ot z#pgaZHYmj~S0O_vI(%P`_V=%)CH-|{PtV9Nrpy;dMQ=5E&y3SfBO;Y}FYW~XMasI)+wtET1*>8ci|0ZUxPXT=8C516`w6ha7P)#2*o2N`=I0{|xX;Bmxu zF4H^_L6s`yJFkl-pz*>Wl$LIA9P@LUGJNGq;wB2wP4GIUa1X4T4#jb`EMCqL+jMDjR$lvm&c*-gi?JF z6mP+137zV#2R`%oum$?j+~l%Gtt8q$BOu!;O#$Xn34kM;P9X25Ir8)p|3k@QZ$X*# z(#gg{jES27Y_sRD$$QUMC?QG4QRw_yGh!iFY|O>`_b++GuGO|1;zEw*g*|<8-B!GO zq|4XNAl>+W0z@Tpq0pe>u5olkuM&1`m|zJK4hz8kG%ZlCM--&at{%f4qK~v)rlGx8 zC+9;7E-E_QFLWt#f<9ip>u@maveLLXjLSF-`}^0y(n1oe-%J`{0J!EPY8qQ|+hQb^ zqGu<-c9xtYx*UZcFGryPP+_@-nE-eSglUz*;Q4_pPS4`L#jxNyexM8M1{z>HI_o9? z#s~mz{S|ioKrLadQlhOmeTxj-u)*NLx*CzojdhgLKXhKRzUY)_4yQ#j8B9oAR*S$VD%`OME|lU8E8e1*){IO8~|!pfoN z`knS%)FCp0oZ{otxi(_HX`lwYAoaY|5~EOoMzo7yX zkRc*PXTd$h^KX)UXac;0&Qi5B-XEOB9Io?TX-0juFsfH8y+~CnK0-*2oR2@>`BE_n zNj%0Rz+V`1UV!bmt;1MM!kr(A?6gi^rwI+8*OOupCp{U&W=wc2-lXTD zJBRk*6S};5WCfR42HI}&f?(?`gz(cS(G>gIOJNc;OH*=jRJS$?Dcu0Bj1EB8$$RgaY`$v6qe_tHdGLS={7Vmk-V{p5y;(ht z`z9Uf8+2C-@Yg#Z#Top5D5eyUn*P7+Hc*p}QnNhs({JjZ{dR*+f`MG{&t0T7yA8Q7 zWiN+g$`cZjHsq;h1*pjz)^tjl{gd-&=$J{2A0Qi+FmrYeT4hwo{&IpOS$a$HAM!D? zki#fXztCPKYwKfBgMaNjr+B?gtPng?K~tI6PRGZXLM9}}ugv(h zsQnf5fCBEJmMnWsTqqptnjj#`MBZ(nP_25}cw*I6)|IsslEqnPly;eIb{}wyuP6sfy&H4T(s0D5V8~;Av(pF#u?6 zMHo5v@y@yx$A+5xCoHb}w<*k661~%VhiQBD5FGiB2V6K#?9@^e5{~qxb(HJ?c`AjM zmVB`UdLz+j(Uuks6#zssy^}Jb^)#yqp(@WKpy@!Glb$+P)5iFjJ*9bnEg4LhnduWh zN=3Ca5jw$<)#);=U`tT#(9d=OBzOVU?kCZd{L^l^{@g8~Hyc3`orVKsP5&Xs|3HoZ zpv2xnOrwY^?;{lx27+ov54HS5tNXJO`167V>Ibf0 z0zDtWTE2xY5o^YhA28+$jZy0W!%!+q7G<9kppkg>5IjQ`E{#Zq!`pEkw_hCb-i628 z#ju4Zd8gh|wtd3R?zu<} z;UU^B*W_}PWQ*Ne_nQL*O4bh@Va!o3H+(`4kUIA^rme5GjADA=2w}lP7#7_*KYLC zOwzo?YcJV=hIX>JkDp+Mit4qydc2?5rK=;yZ_yv}03hNEC=Z9x1~hbfK+Q%D|JujB z`g07lbU;I65?$hw;)*!vMi$wPnpt4j2yg^?m@5)T<{QwfUh3&nu2=YIrh`HOMWGMt zD_;PSZttt8W>-mjxPL7TvW8)O%SQ(R%OVN6;Z1%qTUsru)r&1oE7AHEV_teE0GXNs zgHLd!pxj$w?JDq`yoP@Y!{CK$kbZ6E1>f(BDF7*nvs)1G%(4VjB@PlzLdxO~!^HrW z`wAg*%~N*Ie$qZ(xh*yPdllcE#Af-YhPV&^GG$sl$3td5{)RaITUGP=i&S10%3$mH z=~o*Ok9wUEzO{7sc~Qlp7j?t%Tx^lA+0XBIP$%5A$E5bzMUZi|lV^w%W}pFXKwR;@ zQ&ZN4iu>+-e+2U+;z4RBE>*=@ybY$&=0K=%HYwk|CJRHih;CKvPPa=T_XYL9rLbE!o64s*PP z&+`gNF@tZ+hRy_jx#giqUV=#=QfT$To3JuZ&Y3S9uR0i5djTfx#nkikISxFQ;TIK} zUTB64E3gbBsmv=7fO^O=4A7p3KbSQT-!74J1LUij#9-lZE3qB#2CF9ZJMRt1Bb#zSz_Zmd%&+Qus#vbTV zijbB7BmE4iKxg2y$Zz7oT6ugO!>Or(gzN)Ht@L5Ot1RQbjY)n|<^x%Qg=p>HIHRcA z5@no=bm#kR>?#w8zQT~6ty#i5DNs>H#$Jj4XtR94dcMUdiD46ji8Litv?fdDZ@75N z@)8sj!5@+O@*W?$OutdQQ-?Y{!6%gM;tc~?MG$eaB}7@FWLxin0L;LKnMQ5!M^UP(O(vk1 z(Q;ax$3}kKs>~KMgPTfA1k2M-c-p`K%I-$7~3-N83 zGosS2Fu<;$9socoPwF*NNNq|>B)VA$ZEXYu5gq>42i}hTwJe+{sbCJ+csswlP!X9e z$B>b=#pbPgzkgZyS14a<`>;B?J@W0t#Oo_luL!iS%No6Ls(cc7=@ioN5CuW`X$A|2 zLh@~W$|VNw&%u{QVGUmL7^eVx-uLF4_)G@O_l$)Y_>_t4q*9weafE+kzMW)PqKZfH zdB&444nX+(hFd_{TdA2dF|D8Uk(T-w?Z3I~a|BgKIpu-CRRS$Izf5P`YO za%XWQAhI}1+W3l%vfCo64;}3u%9Ad&fn<*{4R83)Fq`rua=Iym&P*K$12%6(AFao> zPY(e~jI+w~OriuaamJzY*pcOL;6NcQpzrrSctMsgWW=wbT|}R@0=V^Chx=zWcYx!H zBn3n8V&G8AiY@0|`sLFAWfC7gzGzqe?3>`%QX<5{E2Bgkz`a~bF8bDmPs!V*=LQ1= z=%_Fs@`*pvgKlCDHTLCom^-BpI{soG*OouHlVv&Ky}av!kEgLHXEAauocp!~%dtKrOsHE8Tx~+5os= z6qRfCfAXvTH0GJnj<6e#?Dn}2V4d&~9dB$}NbxvLb*G?aItvyMH8xyvE0}yt`LBa&@1EL+LB}G^I=%*#}{2*Nbl(6k7_gV zrP{~gtLoJSDIXAzXpZ*I0S$}m?%{8S#!J^Xd*KgS4Ndx7MK6rqNE@>ob$izq#8wIPmCa4Ol zcH1IaG-_~1MEzlS;9aB+@7G5R<&zD+cpwp+0$Alq3iXU(Lhn^!h6Id)&k5_&M?Php zGh)Z*v1%(0^0jJ!Jak5Sgzq&7r1}}c1QEpqTD2EwxA1y3BH0N=XyKTfpen$Vf~s=CT;Fv1eiA|kcCu3I<74=1?*<~@j;Z}@1DsvF$NQBx@zi?ur{0Yi0M;b2 zh=qTkgMgS}x;RrBM5#|H<+aRh46oO#&T_b7F-+v4vC%I$@-F`QQV?l7S5Q%bOFR!a z^fQ%d-aRunKHmt~k>$v3J;h?FJp*JIz(GjYil%hcTYMK^4_d3Q{fdv80@3zn^#UeTFJl^;Bp#hthU5em(;0-zs z7mvm~vRsb&8s3^8pZI?Hk3UB36=o3eZ0b`z{yze zB){&?JcsnNUZjJp9!NpKAjma-M1=mzy0E*ffM7ro!PvRVs7Z6d+Z_5!YuES3-)F8Z zdWY!<)u3__JWk*=Plx(dAFA;@&LPTKPzLOjsK(c8Zr0&b6CkOncDa1ycXn?yZU2xI z`+BkCrkUa1&)A}WvsPOM2V$g6w~0?yYvOe9fx)utBJBp~tnpjZDW(Q&d{A<#G9(sf zlZacrkqTXzsxv3tR>G-W&*wFNT!I-+=rG(e1|oAw3y|2qcI&_PYSk1B5K_elo^-vw zJKsCjv5b&tJp0tw1O!mft=Gd$eH(44suJyM+5kTHdJ`lIxBS2FRZ!JHx^`rB07$1T z|85BVORoa;>%Zt#ki+?hB*=f>tV#rWRb7<;5R9`!eWc`^kE0#MA)P@WdKm$>o|xv_ zfX$C*ydET=Pc;W(a*hfhjEeH~i-JHl3ae(&F8Er*=#%8pQ-tPslz_;T0Qw@qd7DRz zbCc2j&ENAVQLjdDO2AoO5wW~XTuuq?A*Gj$97kaeLWQ3Q`w7Hk=mP@Cm)0jT>Nje0 zfmhQ+rk)iK_mtiWNvaLJoh{~z|01s%xT1J(M*`#~K1$eX@?zsDeF7qf-SYjkpOe3@ zsokpsgs~#|aL5jiC?UqU0s?U*TkepzQsgX6pOJ<>;N=~tFyX2%K!HBPSJTAiy9GQj z*~MxnzqL`RM;=;7a)UfZinP}PbWyG2(`#i1Tc5JUnS%>9%5MSoCQxhVhkhn;`L)B{ zP1kv>VQUENYBzwX=Js_2vB#UX?6`V8@%INHVCUH+^%FLS6#`q2Dz!P5v4A|+uNgIj z=?rxgX!Xig?0mo$J#!e?W?k)H@%qT!w5lymq{(Mlc2+xr=Ma(KbyAS=vo{15&Q*Om zVq%>GAXKn6!U^J14M>%dWH*GELYT_;qVZ<0k11Z`_$Rrce8UsucWKe}FXFMDoGe!J z!+9Ocbb00RK$>yI$-^lQd)TfJL+GaeXlh3s72f4Gkc#%E0}+RZ?%g`dB>@Yz>jD%i z=~8ZExqqZ5%-euK;Y%L^2G&!9K%;Z67KA2nVrhU1I=pKP&h67AeSAO;^S|p=NmH0v zQCQ`M@Qfo%a2KKyIK6@dk39{VY5>_HeO#f~$d(taPY?USKcX*fS_d_+ThH;1`zL~R z8Ro7r@FXee6`x6(<8Q%yq)OF9JP)rY1P|_47$K7x0qudqxCUFDdO+Bg&Y(jx%b~4zZVGWwwwaRWR+9 zZS`orJHg%_A{x-0Gzk{DlQBtUVGHuzyUvR8tHxs?=hajBMAw5t(2SWO)+gRT&L++$ zo3UkueAgG;%WFG-0E)1vqszUms;RF9Hwt^$M!vPsyQlD2gKmbH6xx}~q7{LJYKWoE zN_HL?j0VqwbXyOmp|+AWs`skS(uPSFqUpJa_7ECPOvcH9p9>`19SFSv41;$@ZZX#$ z!57I6YZp-KsSVOm^&z54jX@f7c$B$uMk+rVJvDBXyp@LiwD4s-bdbZ5l&1>Sc6tEC zDibA|;#4d%Vgl!;F72Oz;S|Kgx2ja*@{veg~C*mnvWX zK4bL>aWydwlxMfG?dA!0pP*V{=!Op=F#2O)2E+T#7J z!ucHBK>z*tms>tDpM;=KSK!iQf^fT+}O+$xG2EXFM;AWauH)3c4B^84(4X5;vQr<2l~<$ z@Ao4EVPi_0tepAu5!c2>bSViNvxf@}~XHxtB#K#A~0t z==tifQ2;rfkTPiS4)!V=XAM;3XB--!9>`Tuiy$JS#Nm+PF*TT4-k25Ju2k*{b`vg| zCCrBEU_f786|Ax!uOd%@D*$Bq90GhZ=6yIVi&3cq`S5$_7@+;dlO9?hHParBK-?F= zw>hKSsFFgn&^g?7Z40riJMqe3fXqkf$&h)%FSTPHTLjUzjGzbXj2{IUHHweF$u`9p zTfhSD+)tI}3EKk71Nwo#x{d+yF<`>2?9y!6R)_cmymxI-TsXilD1poQ{FYOQJu~>e z8T?~2BLgf*prI(d+T9}VfvVQW=R`fN4g$fOPA>ZLtYuv9$K=LE40s8Xn0>RoawYp2 z6VIm1Hz^R1S$j0E_RUrRPf{eV;vk^3qpXn}{HKLpeYN5YHCKV)KZ`nUXb>!M_!-h9 z!jDEkX9bHq<*yFh)*fhLc&ZR2C@JG)3^RNByhxGq01zNj60Og(G zd8mgE>X;uc+}rJj_GAg$(1LhL^XV@yOPcb;A)~RNTgV;W0H9~xk@2FaF`7h8D{~ol z0&nFy6!Bg!HQb6hAxqQDmR>VonPGDG07_Xu_=|?#3(SOIJ@hI>zT|V$1`yE3Jk|-3 zSxwk27HJ?Juty)!CUBJ={CAiuxwa3Gdr)35a6>KNnth3~nOmY04 zS@Oy5tb4GE<~bzDOlb!*RpUP1QrKtmBAp z{wHQi*4u242TCJmdG{jT%Q+Td-X&#VHin=Lpmg50OQJ5hokFSqB zGE;AOt#Qc!gRKFMO{7%sYcG(LKf7If0025)0@-M9xzfORoTws4`4<~?e67yDh0ve& zI}%9uDfp>UdI0UbhH%vNcsc2v-)&6-@7ku%0jWLOq7?c@-astiK4j2GjO6>Fe|-0c zg_8(MbbAM}oo)!64+S}f{eu+923Z6*!ERBRY=Yo7LzU8S=#z@1QTt7SZJGijLm%A% zoO$4E$MG3wX4EU-g69RuKo8=m%oV5%rA`bJ{PlcJ5Q12}!d=0i2L_mbJfp)X28W{a zSO}U}0+Rfb1I3|T{>W|MknC4~hxww&An#gz9?%U^QYlct?5x=W(cq7vJ_fQwO)oW* zuc4hQAcqfbR6gYPGGMl4z+o_Bh$VGe9_0n{UerUCy7u$&CLPFeO!&-bp?t%i z7~BQS8%Etz^ef9wbpt5f8yaw+<@rh*-P9+h0|yZz(^78RJD{NGA3B0TyelOwf<5pK zEII7^epjHrAn7@5!aylJ{3_eylzI+CbASR$Z4BKiD#b5A8)jt$))I;9vU4R#?h^nA z`?(WX?VS1eHmi88Pve%D%I|&jV!nZtexe&bBN|IP6aBeSPk7SI44niL4TlUVp=*^`Yyo1-x|x;$I&a7Dg>qnt^r;s zRjNNPSF0ahBg7K{1GEy7V=gh68XgdA)(LBJy?@P^l2vXCRB}44ct^mYV=E{UEWX3#i_6cUpRh;&#UXP%eR&(`eW=GkfUxv@3 zM5NZ*T5;Skr*rM6u%ne|#B2^gI*#>uqJNbF0mJ!`0{xS|>Hm-dL9T}iiLVq%Rtyv* z%g?Nv5+7=(`Qxy(&MOj{7WfNC3d9AbJmZvnQN2KoAcv@DfOPY~qckj{`vG^1<1kLc zu;4^oKteg_VsQL}e=s-!V&qZh5Pic#__?h^Js z``(N*m>d|858~P*GKfK@XxG5NHhGB}P|KUC1>`Wq;62WS1Hj6P%tP<{>P~7zv}~G1 z3s_Q6fspnCte1AjwuiWb>w67)?FFva9lQWUc4{i!OTVsXx}zY`0nBya#v`z=uK_V+ytHUlIH;Dv2o>ezLK`L*pueea~3-WVmH_G^clWs0N20&T(|> zHAY86+K;l=<03BG3M5=zI2hI7W-$H$TMuOw6of3l&K-5f>;aC4-%PZmDqlm|VaVU< zD@z?0jXG6Kz*nm+2Ae?Yg*T6HXENY9!0(`jkR@d8*A|{i1j8@vaZSXV_pMr&VRoL8 z)HA@5&tT(`>Z7RPi+t}7!ns?RSbt`eQ0b!{jw|pubiICbAQ*{eBV#}Cz^_2U80y2T zU+Ss5*rLN1A@K5Bbt5e2vu=a|osdqw-f4ukmtBIkif1mUB|vQ80s0jf(XR`Xw=wCL zrdRCIwP&JF4%(H4#{=Bw?3C1SiQmiw;ry?Hmq@4{UYaL_ zn01ei07?6?X{5UKRHq;#6BvQCx2!-bwB8r|Z0m@rxe;cobu$tvLlvS^{$bit0;z6QZ?(IU_Hu-o@4yW>>nTCJMDudX0Hj~lAxnI zUVi)O00N+|AW$CieGo3+g53>#s9hprlf0Txf2}}gJW`E*t4aF|hEp<0Ai7xeI{V{R ztCr|&%X9vwZ8(pHDYy?HXs+c3wCKBH;$1hocarT2_BK&VtUkI@Qy`g%&4)BgyjhHX zi=sswO@U8`o^`Jf7)8H-nUiSorc#{8vNPdw`U_bU<4vyy7MvPlkbSKmig;z1`PfnrL&?1 z$J$&A0mnSu9L?SU%8Q?#(hL+`kP&zSY+oMzW3S=dpbi?G#l|9jv!JdV<}N(kpD@czlRq>@X3e9Z>1bsZq5EC?+4EEVtbnh0^r%c8 zL^`2O0US08P&+OXWUSLa$D!pJeL5}(b~~?} zz~!2CGO7pf0!H?xe0<{MI#o#_$LxsVx1hBy_}nXh@clM`p}gXnwxv+&;V~$cvG>}1 z>&8mf0H%GDkNQ6S*0Py=MzRzZe<;ewf`tD5_#Za`vc@v!E&mQHtUYn&tdKm~7eHXQR!XHI!Z*Qb@UFtzS zOimbpsmGcPa(`r%+%upy7n2qEn&=`g)>1xxYNYG88e=h>ma^NK)pjfpE|5v@1x#5k z@GnWz-zu>|7Sv2$Pgk$7GG(7VpNU6xH}4etSqL~d#KdYggJ<+MkTu9;o6y0Y7Sf=@V^Cg#;P z2d_9`YwXH`WVr5^&8Foor0@LW$@gRB7|#hBj9f6Za(#qcs~B;6C^Z3wNu1OH3daST z$0CAL_Nf-@g}cio)mn^i*CYsh-EWrCuDU)$y3h9LGAIM&@;2DDAV6`+jY(`5?M{^g zQrhF2kejmsB>d^HJ7|HR9+FqA30f-Loa>`|zNQv@wf^8-1|lf{4VsVB1Q17emI<)C6NB2Ro&RASX%4-A?Z1Ph7RZTP5Pz3v6z2X2JwCt})A;gcH` z9Pi@lX9b^a8*W`W*s5J8?Mi(H%cGA~5M+CU)31K==6E3yR3Pl);nM})0O4CrZ_+~r zGoD|*)fSjye-o`#aKP<{Q}BP~6hG6RXZ~aqKhyq?W1@fO44l(~X`a#-DGd(#8o%WH z1?=tEVYdbn?UOaZVrEpt1JrG8Rlr*=6`uycJ*q6|Y@pTl?57s#~(nfA++UJ!mi zGzfi$dA^o_%06PJ{ABkq2M|+$nq1E*e{abu#Q0NzjB!qaTZ5iUj+f6?g?w-Zw1S5g zanW&o2RBE3HoxnP&Aq3X+AYA`Z73bobAZZ#1ZPU!z2VjQb=okiw`Es?|GUBj2MNPR z@3R}}JPQe5BBu`LYbks=2CpCFa|zn~s3Fv4as+9g@Oa`}X&q=x9T_;ag^C;Gd~_N6 zJm27ubs(=4` literal 13801 zcmbWdWl)^k)-Bw)yL;pA?ykYz-Q6L$y9Rf6C%6X)?ykW?fZ*$!bID)yz(NnW@{WOI@K6_Z z@~<-M>P`93J>gDZ*?>OA*2N~F;=P$EIAczFxjbZPLq;;bfy=V-E< zeVt+rd)8IROh>XPs*Fx(S%^D+OE?@8VP~L4lEUAq74W8P;yUF#$}55toaJO_0r|1j zhhIGLXd=y@_5?|Ha3PPg^V7iIRS&Mwl-#&$UMlBoyjPe^NQbxFdIST|Wt1J>hM1h^ zT$F(;XHhreZ||4Js9W8#cv1$nlXXAh8Du_R-PzBTqMi*pfiQXv%GCkJ;mLPpMEZ4&Rbx&6#`bk{5W4EFAol(T;S zOni%GI>agYIVWAFcEk+)c$^R0lr9)$NJr+_Bb>IhINhej&FWg3%oQ80q<%?)vw8i@ z+N>w8%~3Kha>04AkUkk z{>a>9^-ggYrGjqHG-NfSIWhwT0bHqNGX?}2@GIanz(Ulj)?W>lR&~+&m06i`#VLtc4x6dFHuV-kE%!n;xXONJs|jsH%vZPsa+$Zzrqw6 zW3&LEGz}F0S3Lq}YNDE}R#I|5Hf!XWEU6rE7!B(HXUj|;L)C@w0r9({+% z{3T8YL5%Htam*`dH;gqoqyWXriHAJPTvnk>^A*!Lu ze-&DHy0Lls>skE3Z(TY^n7M=$AW%S|NCTjN06>}u<*ZDMEPB$d#^6T4RYqrCshb&4Kl* zlrcIeVqA1NDYSX=KDwkLJo7yErKxe&JZ-~iwHmTe#$@ZW9O&1T8m?_BU8ZBdUjokQ z26M%IMmO^-u5k+VRq>E~C+fUMDkN3iK`P%@@4_+RPuDMnR}L_y-m4R14%RS#veCRi%5G&HUI-s#NRzV%-O)CSg2iWV67Ji(4kEvVhiO6A zW0koYm&8S9Ib{6-yRjvO8|5kf_jB4VSux5kVzZ&Ky2HEk^r1rvF9)rOkIpFt4yo0X74YkMS>84 zV}C#i=5Hv$|2f8gBPKTz8W3xIG)uQiN0BO*L`9VFrq?vWbwaplRvi}0W#!)BqH}e< z((oD}(Wk~WRq8)CGB~*)sL;HRWxRT(gBq!UGd^Z|asBdyv*iU4yOk|e3X>BLPdR0o zu4!aXwz*6($TuIx!UAXju4-jXy&0u=ILa9z;&@1zi zz*l#y#T|nAegeFZ>`jt*ikM5}WG`XLilV=C4bnqf;91IY=s!)pnb8e+K_Qt@XBnLO z0miQ&DuSK-uWCiX0x~`rPO?w#>Vx5mm*ggjN?WYd6ob*qr@6)O1g9Y%3u_8ZHmhQU zq}<2pNzbMdRmhZp8^MWFqc)WhMq#EJ?D-XUIX_RX%+|ak^AB8OzKCKo-0*eT39hA<-Ju3SNm{?D zSu>8G|L`Pt87Wl#HAU6exZ#S{zt1>$-f7}1uyy$L>Y8M#$K7Z=QvyZ+?A-*+%$>xz zsLm7`ZxE?awnKb)9mz(@!?}g!w_tVZ3p)4}gWp))tm+I4BFREoBRhmcfxH1|K9B{? zdga~@^)`FlzStqCJWws>uy?ThuE-WVVWP4)Px;Qx`3Qd<%UdB9uB00J-UFdIS{{r` z{fLvdZj8(ti}J`_Wyq^P@TQ4E#nsH+%pRy>V(DgVWntzF$35o*(0V)m0qNyHUv2SxaElwXjc0g9L+^8PsODj;MqpFh3z1nZqtJf^qdO#vER*foY~| zDzT)*b9Q3bha=ppp=2%CF1jyN=oSsqSapmh+sA+K&BuV0eV1 zLSmQAdsu)uza2r^9ngc>g{=J9ops9~qY8KTpATumb=L3hLdi zWQwt%lyJVX-a%^U0%Yk(D5sG;x*P=BB1mYa5ns3{1_Y*M62IiiEr?C}fW9P~{!l*SundoB<4reegQe#fAO z;vH=6(`E91FisaD``bBt3iX6qkhCKr(=C@_RT@>JhvuxWh0Y6}|H z0X_@zcu+{@`Hh&q@1(Jrl$9*tZdY^r&Y$G?+gP28ukON*Q15U9vd^ ziU-`JN5rz#ZTVjnw`#@)%3uLlSs2-?iY>p%mb@top*Isu7(Li<1Fpi5#g|zkq`|R2 zbnOTC{XqpN-e27J_nAj~2jrj(#r9DUAhHyFCdli9G`!zaV66q@pkqr(92Cob?&1M7 z;s%mqWb}^@WPCtN#mH&}1R2om0|(MCr3Q+AgW5P&W9Lbs&qFSAXqLUGRw8EJF|fPY zkJG~U%nb7u+QWJIJ%R+$2=oRzE7;auI0cM1Fc;;Qj`Jy=>oo+;sfNG$MZ0Fs9F%v4(Y9b)m=@!NW45S<*xtXC#dQEf76->>tkg?F~PtTD|>uKDan z>^zK(5U|)qxw&eR3(uQG>Uc#6xW*2-6y@HDmb~8z5Ph5L2g8+9rj6ms8@JK~FSjVq zITh271u!$^Vj+gjrx@O<^Y}jRdkVTYBjnk9*^}Q{2!%Qn4CPl2w`&S`BtCIlk8tPN zSM=IlkVR^Mm~5cNWa2T-`Gtdfa6RKX%Z6kWC%7c|iBaV2CS8FD3RAS#(lYuCyqU$Z zOucZrh*k7cxtPag_@2Z0#BX+9y=9hg212`w^6Tvb1iK*mCxwoxs&GH^>}i{;iD?XW z%G5!}x{c8{jx1Y(S+tvhWzMn-!vG6GJI2`Ge`BIZQ2q}M4-24#098fx z3jb(#5HKJ+tN{>zjaCpCurSbY5SU<~Ab@{OS2DR4>H5$eORT|2@19!=9ySo51oCqO zR3~>iK?yTCYcI&aAq>HGC|lPv=&&)nsjV^v$DA2FSZ#R@)aRo$?LrUSU|1AUD~@u` zIV}E_6fjmsJvTzNpZo>S842V?3%+h$1`V-jw;bnw(N_+AX&%=`{0r3}!JC$#YuRr! z<7(wP0&P)Mg2gVBw<-4DMRHLW$*xX_qR>8(kd#(Z5u&wI9y7fx&5D7WUfL2B01_4%*M4A#) z-$hltS*`b0=S3`?X={i`Cu_UC5>=)yKkd_8-n_+~@UI!#ghSK@+O9JI_Be(lV zYBe-h83ddEy#MmC>8Xfa@{K$U_6ItE3lg-Kh&QHuxbpLzMm5g`f};5aJ0F;9#(1YR zeKnjFV{B`WRbM*SWI?r;+mA|c4fz-kbB~E9UCun=`)?b~CsFAVzCk#AYZ}QEhniw2 zBOn?vpX7&Tcv9goYER8KD>M$+J2(kPQQ0tmQ%~ob=+`yz{|CURBo!rrpUgf3%^jS9 zDn{-`_VypJQ!#UP|7)=SFYqG*XZnEONAFWb^$7qa0RExXzX3)AhxCda(XeWl)57~= zeS4UiO-T>S*iR*YkyP|-dG5IX@(Q`JhTJ+QM0tG;EgZ(x=7U7|mQOT<0CIhT4`zO^ zD)SbGlxSx9RT$q$lQrkj!1XCVRPSS#x4(Ov@-hEA<5>&^g@bvBPQGO9~hH|j!8_LH6>v^-5Nh9L9Qb~=>7A>q0%&g4IbSgjw z9i8P>Ro2S(eSws;Q}hY66~2BMAm~E($ZJN6a2K^cI7G+Wx~JmcB-C!E>CTx?+%c>n;QOE!4F=5LFPr_ zX6*Qc(m_Z0%3^CN6~QpEbCM5(EoUxHKJRuL$6f)wM%||u2`c!P$v_PO`iI#5*`T2Q z;r)R8cdy}Z1c@6Wz59SJQg``MOywf`Sc5*>d(BEg8VAuDN7)j=JWbWpQ;1N_W@Egc z+tx8I90s7B`&Pmae5cmUU6*i~8_?v|6b@hCqY%4)9pq{k?3kQ;0`yIPyRpzMv#i=n zKm~xMmpY-QRFm)rc!zdaeOo56*B3$?=IM`;MIAB4p88=?v#n!eTOmx5M7 zNNU~l!T6fb1A48O`(zLErh3Q=2y7p*Z1$u$VYA&0&cHJY5A~*q)9gdYU9@V&dPr=b z0bu8C-c>AMcwDew_;lFRAvx2M#SVoO3JtW~^po<}pa%h9d&f6{c7pq2fdS!X-Z`r@ zZSur8e(BkSDd`3~@VUL9_9`8NpKZ{7SY>Hw3>v1`UbAqhk{a(jdPQY0vvA+yF?sU7 zG_l@%7ZF_`^+2)+obVRaj??PJ!t;PdA)JeJjLPQy5$+ugK z?K$x!#9@q|ihMBM;FPO+hIcob*MEI1p)}w+kJwR&?3C7Y-f;+kN6?$NP&R2i(6+O+ z>YH<|Ds^~1k9=_?cmLxT9;oYr;i2Cn-_c9NuYTXd#B*-tA796?BJN}93k?$(tV8^f z;Tvi?b9rdQ1TmQeI|m+yqSp3WF5IFLoU}r7abHtmh6E&xa*^zY-F@5_e^k5#WIMQ5j3LE#GcubQ-K{yn@MXYTd?*;%hvWmVXQT; zjR2CKRoalt9?Megin?v9B{CUe#4m0o3IO!$p6wQJT(D?(Jh*`UX~pzYHK)vk=mK@925}b%FOviEwpsPFpA!r8ApXEWqm`?T zj1KIKuLqX-zpF~q;zEpkEmp})f4zB{k%Lv^C_#(ZIoX10L~gQz9*DhaCEr_d`2So**{-KEq8I3!HYXp5)m!zl6rm2Deo*!RY#I(BfD?{Hc<-du9*U*boBGon_e+xjY%NKvKg zocT}-xL7w4&UF67i#_Oq`xj|%7S4!;*9`n?{=0OQ&uzK30q^wyjJgyW-jyG1Tf1d!;4B-xGtIs}bgd={? zEp$g*5#C1jm5VusqI=7OcJ_W0FuQ^)gyEr<93#;%xNX!*OCWI2&Yl$g*^`eB&b`;~ z{-H>e1ZRwFIH`oC=R%;NK{oQmrbM(;_6lLDy}>UNXHLTI?bv1g4*NZENKtdV9xNEm znX7uZE|HBm+H4?bR+yu)+2-i!z@_@nETwE$rt~pO^5(ehMtQTVX}iJ+eH_&xmA7*pc8Un=19pabnHm?)U!X8!uwv=2@$a zyT4nnCU>Fq_{sg9Bx}-u%~~A;Gv%#K-BuEAp7V4Ur?@{;1l?Hw*5x5Ax=1xpsHXci z9qoJ2t}<`TpgW1t!{KY#((xd~@5n+&9TgNYG%}VeQ6sU890S)BGjtDZa^CpGv%LoQ zl$9nfzs9kq$=$dGFy3X9&-kZ-Gp3fBuWoIVjyu`DkeAch!zBl(Rz8#3 z3l~qDRBPP1)mo2fpQf!?!7z^0k2>i9rjy3V@299?7|%`&y@Gn>ZlyCNAmJjZhO)tT zkR9TbyLa)sJhyWtCwS&&x=o`s)0f1Zd5rA0MW3YW6yWz8XylHE6wbF%dAdW>7k&Ul zhn9t$u9c7$Z{%t_MwOLHk4_DLtKMS{VHJbNY^hIJb9^5h9m25yu&I`2*VND6k-a*; zJr1&8+@f4IHlX>KgX>CVUZ~7Tst=hUIn&AN!QU&3OZ$__&=bB1m~R>C(#JHW*Kkb3 zCHIg(ozOaL*MTF4bY$f@vL9shK}!5qhxx}WMJ{RO=3?gPX!c?6Ia_^bTL&PYh0Fgu z3R&2@{pBA;g8nlV`GcN+8A$(KsZj9SUG13c{2sMHde^AN)W!K+mh&*OvSf*Tfa=}@ zEq==TMz&d1bTcyrsZV%J8ldP&JN_J`& zuYUCpYOm3fi7!6}u9y)t@>}q;3Ox26c_yfs>nF?Gp6Ap!*MFm9p!rO8aB(xEa*^dK zc!Hx*M~cIcJsE0Z+sp=k?*KRqB`}Uv8C8NyYXvwKR>Jvq8Eb%xE}DIVeRG z!U$xvjho_Aikk)t%>eU$i|_U>HxX@SM+;Kp0IGALd?>p+WCqI#MiQ zrhBhe`ZJoSJ64=#ok}I)ydypCeY3~aLr0Z?Nyvtf#)=Vwcpf!Y5x^zA&~6tAis? zYwk1!m5w5m2(94hrw=w}(iTWID1%7FM1Oh2j9DwVKmODZ1;5QkA3x}P(7EL?PhXT+ zZh{l1p+|uxceoZg!N^{!)q%+UZtN}~CCV6}-pDI!gs_A_|z){1o6nfT$_Eu0yp z&uXRrMBBvXh7v{>r>G<}lzj_F`LVvVqBAB!0v!3n2!ezFRkkbtYZ8J=tc&SmHMyy9 z1?116MqZ))7+DJ9q6qBibMT7e2)XVRNdva+Ax19#^`48zpC z(8~F!L2epc6BQe zcU7(A7vc@-LX4X#=sc@#LMY$wNRRo92$-J$PZ6;awNFV(gkG)UDwYYr4k4;QrfoED zZ3o@BLk((QQkKMHRE?yP(ja2VpQ*Ke8VT&PTC7gBp><*~1QYYf@>LOH<1JbD9T!1@ z3`KIhQDlsch>GXm*74(3OFcB*O{Cc78#PfO)6fUbfNNHcNM-|<%n_eY_ORjKYuZcj zt%rHv&24O>Z@aeCDLW-MTX$3@NQN>MKX<_gz-Ua;jD}r|u{xw=TMsm`SCBM;Non%f ziZ5>r(|tk#m-BGb=7bE-ymC&Q(_*5*t^LkR1&c){1pP=hjfY{bvh($zDSPxGiKpdJ z-4-+x#b0cDJcmg>BOEckpfn5k`J;ts>R^;_*vRtNARS;l3E|{(D zQ()1=4iAo7fja=q;(WDmR)z5PA^0M6?zWb#kC-qd7P};!Pt3v{5E&=5?!)VdylAne zq2Kd@R3_Wz32eoUly>GDu&8J)dVemxj?MVe)L+*@=EiuQVS zom#!a=aS#8z0dR)UjWH4Xf}~6g2vZ(Q?wrCIVoHfuN=qqcU=aD?dGsd#Aqe~(?}MK z)xO1TeC6p5BmrUs*&`%6nZ}%ft3T_)EI@8smJyOA+j{Mz@sEIIgjQSG-`pO3^U;~q{4y==@R1n}jIAOmw96ofe=xt1^4{B9L=FJ?b@*l(3 zmn0_M_Cl_AbKU-ku4Nb;Miec__OC%mt((4_E7$d1ID7iaZpqCKW1uCHSB@1}xQTcd z(CRj4;>(9s^=sDbU<%s6`)JvO2PaRb>vwjn`OpaWrZ%BJIE3Nx{vGxWjUDzP5pb~l z`HWj_BTkN#kAD}AsKxEKo__%;y91!-6$Aa^;CCIglYY@pl9r4M>2<#)n999QMd$hb zItY*D6|%uXlV8hiv0pbDq34{5qCb(`!GwZrq91{Lm*|U$DI*;U;Ge4o0%UDJ&y)`b z8~hS^ihDO_Gu-VFVv|jQPrC258~)$1id_iE4+0@&e6VEL1S+G8h_I_1<0wOw0P>?V z>z0`-jc?lD1h?OG1m$?Ps4D+VlK-O!M_;!tEYrHfbar=;4RF)*y))ea)lkp}xn-GX zm7t~I$CIfL{=r3KVdS3m{);G9Cu!;1x2Mq{4@b;Gnsq*T67vjioxvbgi(Talq9A95 z5U1*`X%W4@R$QDB>j*t^3SKeYc?UVG?+dNbP%WGc`@SdDbOcL6$lifIxH96#w~#B5 zN^!PbpT~t%?F>@3>PIh5^U6hCVdm-4U+Aw)VNC0w4QaCQ zWLFNmc-`nm((&bn>pa$`L}wF&Iu*Uxb9lp8c;rUM6V# zH-)UPzup2ZvGkXD3g?7>hsB7oUU#){%+(ycOq>FNcnZuNJ8wsPJI=i$h!&&^RBj{U zV&By0P~z=G0kksUc%(g`NVKkKgdK&JxZOho%F(uZ#qVZiAo<}+9E0alr^{=*yR3Lz z@N_z|ypY;ODr0ptN;O{MZe*75Cu11ROB3D3qUoc2nXTb9^GJth)R}XA*m04s*Q+f7 zHx@bHs9~(o1^YTW_&BZ3o@wUuxq{x@)y1Uct&7cLU1uEcuuU22s)LnB2fRVmAEqP% z8GMzf)Ky8#kD)qA5-aKfl>akH{`1ztKcwDY$<5!24&(&s{gVpET6d)Icya?u;%}?0 z`7|C$SiOwLXcb+78ZNK=?xMYFhV8UWd=zwBFNNKjN z5aKcnk99q(ukdbV<6s$13jFGiIFtHCODSz%82>qhBRAz@TG8>D(ApaI1^qHp6N=z~ z2xE(q*v-r)^d)&ND_}V=tPW31bX)yP9BMF(sE^=VA*bhip;L<;uOK2q?}#qjjoC5< z@hwy{w_uCGNrb@M>azhTo+4Uyy>T5LAf|;l?+}#@bO83~S7!AuiY8d24zQLL#IzZX zwWas@;bj|F5nCzV-3W!~&d{7bKDh&)Mx*{TS1 zw67k>D2fDTQ(lv+i(92l<3Okncp$F*=N`1C8RkN^hzvg@LvH@k}%4>I@r;q7(` z69$M4c$IARuhzqf*l%eE)H#z#NH33O!q_FPd z(@mte9A#s8({B{%f$I-1BZ%+BctWgnm6PTJ(-hiHGSo}MI}oVlRCkM1h2+{B1#z2f zOBD%4#+CyjV~WfPouUIO$_5D;$psUS5@zIDvPE#loAs2dM_ z`vp5&0y7}c5l#9*h&aH5M|8&0wBBVeBS^s(-yc$Ri-iPN5w$%n>w{N0q`$`-9;Opk zoZX=*Tc6R-V**P};vFE->4LBX2AHx?UQ%A5d2zYCztyALfd_pNZ6&;^63RKM&LU1p zEI7h_vHSs<8b7AQ6_FrbzvAn5&fKA5Of;o{xjyWg55Dqq^YY1@14sYlZAohMwzNpB zq%Jgd0+uBNm%BA@@7QSBy=bu`J};98Jr!}vbGr37|FLF$Q_h1LVpn*5({8TMJOV)O z@tR3n2h!E&X`wMJ)?a*#R;?==L%Y7+bWSWv)08jQVjCmzB;F!)OHv(Qm)$ye42Gcq zN=16QN1*l1XB=MC|-GUbp)%UeXuraVDXpSBd-0f6S0TRVzE7@<5lR%f~GdK36L{ z24^?3KQAAdoF{|n$ECV|1#&7M!1>GX2J5!~{AVEdak1{-0y$_V`j$cqa4HR_kJxwb z8EVi|RkYrPVPB^>uwPiR;rZoj8ilZy=vq)S1QV~B->P@KiL&VuD^u0)tnE@#!sCcZ zkPyhR{80_;jHAa5l>Ku7GRvJ|^fEebW)S_%8%g_lJeRh4)NT%LL6RtoeSdtdP>jY( zXjw#oAtC!O{*-y^w9Z@!Z4_M6)#va}(ZlPK@_gA@wD7UaGpz7_3jC3!brfHNFsKbL zQN1G5;n>>y;=nO9=OadLYF;JD9=bhV*d&YzJf0&?w|Hy4>#|?$ORA-Pfczxxcn-Ki zu_y)T(PMpgs4y2i3ew1u%OdI6RBJu8&u|z-!xU^3Y*ejWG+3}5ti%DIxzW}EtcvC? zIB6En^kL0?ffA@`24Kz2cpIA>#Z)MpLPI|ddC)}O$~e@@r{mEnjS+)athR}}8m67z zOA)y0bL3DA_BikD>uM5WU{FMrhh==oEG{Ea^B$?d_5ECb^DLg34}m$WwZ0_?~u=)W2vA__qDQJkkr-#^JdysXyA zdX@C^>Z2@aJY1L)AQ>|=x$her(3AziYU32#tj>bwtQyjaVs8kYc&+@Ub)f&ukSe_! z-G4ky7=4fLpC`=1xIY8(f3EQ|LOi68$y-^4LZ_la%OrVg0rG_0Z&%M4$ZcL+hJ=e&`J>PD`=5NHhb8^u}0QeB;*#&LmZ#i{B^??egjA z8bO(r6du**g;Bo{Px1U!z5k%AiR!brWfHOGcupSCQ%HEVV0BKyydZ5Ji8u9{L%|8I zWkT`UBN@AU)0rZ@sbWF133swTzu4rYHdQE%l}nJPu7)q2UIBfvWA16Q@)Xtim7R>W z7XuTRz*IxkmNy>n<@f_;dS2@7ikM4^`?{nDbJt&oGZ|Y*RiBH;_^6W~9uqi?m1@ z4ZsxRvtxmM_=5S&c0S4I^k(y_S`E6^w^;nZ)rtVYGjzEfD~Csnei?&YJ`iUCY80`o zk!1DF`n5PaM%=5dubaLCS&(n7!C*)`2j7GqEG|u%jQhjqS)4DZS_50S91PoM);OgG zWxo`?90CR;AI}j9)9s#Rw+f(q(m-4+msYM>xIEOPn<;cm61C$GA5(y(K_GddB#JK0 zv8@Xg4!2N~ksULro~@9n)|-huOGDp^}II5$$I&F2#0}6TFnkb7%|( znvxN3E!y=+W5VRr%h)q`8Q!&WdFw5*9mU$*^2v0yLK6fOqWp@r`HPrb5N|jZ-gN7J z&bG}sjFV5q?}Br&hfUUy@XHkP1T9W(WlDl-QYV!!)Rr7h^6+!`J!`fgI&Kp0Cx}zp zP()WL?}M*IbrlJ#omG3umU4&D+Tk9MU{K{bO{>y*I0>c6sWEY*q_;bWPMGBjg=<_n zY!LXRNtHBgs#V^&_uVL9Rbr=N9!)x{Rf$+Qd{mPyWm>7~38wC=0u8TttmD3-J0n1PDX^jkbs!{)NonNAw5!WmJKb9Fc-JcT= z*NaiiY!oAVJP9roZAO9fIzW#T4HLLg?6_ani#Kf|1(Ja$-+F_;wEHB;v{6;Az9zTn zD>P(^71+1^@^nt^?9Cgy+2OjtD^kyx(Z^xfkb}Oh_N!i>^HEiX#<<{sNO4vOS?ewO z#_O$p#p1!35S|rlHPdNw%p4xjLK=M2-{wRj?d3>v|7Vo?!*3tL=$Ib#-uCT{wP+re zH^sg(9GpuSPypVEn&%I=UI3Nx#dfIRfTo7cw}6b8^w8mvj;~<`YC6j}z|mRZb~a4p~ngrD13tx$^?bZxFL4B~PhJVZ=V1kTc56 zcism|83p}FjaULEhog|Lc;Jll_y$@?6hUz^){C$F;dV9C^r}!Y-$X*1EilOYo;z@a z=MnW&{Zcb53#pJV#G<=>&V z=8Te+^_}?YDL+6O0=U)TvHDYGxg*y=)$}z<(g;%V;hJe?-3mk9)U;&W2@lF+L>`27 z>qPYP*tQQX)K<5FsrC1I)&W5{+#9j;r?Yx&euAQ|gy6XMuO=Ncbrixw{8!3YZQc48 zx&^SNvO(hf)%K#QF*4GOu-tn%>y$9_+W0bA|Es?x~92gC5$B_|~ znbFaw@7V|*8tIM9{7GJP6-?B<{xx!f_h@Im=q(3KUxK*uuWv$87HW>+PVOU*Wc(7H z&77iBt-|@P_u7Hu?(`dgbGKM+* }np@ML{SF z?OTOIxK~KtJOs{gB6}6u~<)ibsDp`Iiwg+W;2JsOuZ> zHoe$Y^M`ro5`$t{+-K1;$la6#Uu~w6!C`&gx3WCB!4&`4f~A*gwboit*JF2saqV+X zcg)_I!G`odPwDPK@`Unsh#rszntJVTL_uT+o~}GP_$yxN&TyfzEs#Tt%met(K8<$R z1U07Y1CbBI@ZTMvz;GbQiw(|(q7R-Z)f#MCGbT%jFbl_+O4w-nvF3L7tDZveXP^2S ztr7Ev$M+Qy;M!{@=mSoI^uJ}^m=fOwjT>Ko`yp%pLq)5fUYqJ6)mqX~PjG0Qi7d0P IbMpKD0W2~6NdN!< diff --git a/wget.spec b/wget.spec index 8ae3839..b80238e 100644 --- a/wget.spec +++ b/wget.spec @@ -1,7 +1,7 @@ # # spec file for package wget # -# Copyright (c) 2017 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,14 +18,14 @@ %bcond_with regression_tests Name: wget -Version: 1.19.1 +Version: 1.19.2 Release: 0 Summary: A Tool for Mirroring FTP and HTTP Servers License: GPL-3.0+ Group: Productivity/Networking/Web/Utilities Url: https://www.gnu.org/software/wget/ -Source: https://ftp.gnu.org/gnu/wget/%{name}-%{version}.tar.xz -Source1: https://ftp.gnu.org/gnu/wget/%{name}-%{version}.tar.xz.sig +Source: https://ftp.gnu.org/gnu/wget/%{name}-%{version}.tar.gz +Source1: https://ftp.gnu.org/gnu/wget/%{name}-%{version}.tar.gz.sig Source2: https://savannah.gnu.org/project/memberlist-gpgkeys.php?group=wget&download=1#/wget.keyring Patch0: wgetrc.patch Patch1: wget-libproxy.patch @@ -33,8 +33,6 @@ Patch6: wget-1.14-no-ssl-comp.patch # PATCH-FIX-OPENSUSE fix pod syntax for perl 5.18 coolo@suse.de Patch7: wget-fix-pod-syntax.diff Patch8: wget-errno-clobber.patch -Patch9: wget-CVE-2017-6508.patch -Patch10: wget-416-but-file-not-complete.patch BuildRequires: automake BuildRequires: gpgme-devel >= 0.4.2 BuildRequires: libcares-devel @@ -81,8 +79,6 @@ This can be done in script files or via the command line. %patch6 %patch7 -p1 %patch8 -p1 -%patch9 -p1 -%patch10 -p1 %build %if 0%{?suse_version} > 1110