From 9ba865f54d331c550629304cb25e77ac81455803 Mon Sep 17 00:00:00 2001 From: Juraj Vijtiuk Date: Wed, 13 Oct 2021 18:32:53 +0200 Upstream: yes References: bsc#1196505, CVE-2022-26125 Subject: [PATCH] isisd: fix router capability TLV parsing issues isis_tlvs.c would fail at multiple places if incorrect TLVs were received causing stream assertion violations. This patch fixes the issues by adding missing length checks, missing consumed length updates and handling malformed Segment Routing subTLVs. Signed-off-by: Juraj Vijtiuk Small adjustments by Igor Ryzhov: - fix incorrect replacement of srgb by srlb on lines 3052 and 3054 - add length check for ISIS_SUBTLV_ALGORITHM - fix conflict in fuzzing data during rebase Signed-off-by: Igor Ryzhov diff --git a/isisd/isis_tlvs.c b/isisd/isis_tlvs.c index 9a442e037..f1aae7caf 100644 --- a/isisd/isis_tlvs.c +++ b/isisd/isis_tlvs.c @@ -3007,28 +3007,55 @@ static int unpack_tlv_router_cap(enum isis_tlv_context context, type = stream_getc(s); length = stream_getc(s); + + if (length > STREAM_READABLE(s) || length > subtlv_len - 2) { + sbuf_push( + log, indent, + "WARNING: Router Capability subTLV length too large compared to expected size\n"); + stream_forward_getp(s, STREAM_READABLE(s)); + + return 0; + } + switch (type) { case ISIS_SUBTLV_SID_LABEL_RANGE: /* Check that SRGB is correctly formated */ if (length < SUBTLV_RANGE_LABEL_SIZE || length > SUBTLV_RANGE_INDEX_SIZE) { stream_forward_getp(s, length); - continue; + break; } /* Only one SRGB is supported. Skip subsequent one */ if (rcap->srgb.range_size != 0) { stream_forward_getp(s, length); - continue; + break; } rcap->srgb.flags = stream_getc(s); rcap->srgb.range_size = stream_get3(s); /* Skip Type and get Length of SID Label */ stream_getc(s); size = stream_getc(s); - if (size == ISIS_SUBTLV_SID_LABEL_SIZE) + + if (size == ISIS_SUBTLV_SID_LABEL_SIZE + && length != SUBTLV_RANGE_LABEL_SIZE) { + stream_forward_getp(s, length - 6); + break; + } + + if (size == ISIS_SUBTLV_SID_INDEX_SIZE + && length != SUBTLV_RANGE_INDEX_SIZE) { + stream_forward_getp(s, length - 6); + break; + } + + if (size == ISIS_SUBTLV_SID_LABEL_SIZE) { rcap->srgb.lower_bound = stream_get3(s); - else + } else if (size == ISIS_SUBTLV_SID_INDEX_SIZE) { rcap->srgb.lower_bound = stream_getl(s); + } else { + stream_forward_getp(s, length - 6); + break; + } /* SRGB sanity checks. */ if (rcap->srgb.range_size == 0 @@ -3042,9 +3069,12 @@ static int unpack_tlv_router_cap(enum isis_tlv_context context, /* Only one range is supported. Skip subsequent one */ size = length - (size + SUBTLV_SR_BLOCK_SIZE); if (size > 0) - stream_forward_getp(s, length); + stream_forward_getp(s, size); + break; case ISIS_SUBTLV_ALGORITHM: + if (length == 0) + break; /* Only 2 algorithms are supported: SPF & Strict SPF */ stream_get(&rcap->algo, s, length > SR_ALGORITHM_COUNT @@ -3059,12 +3089,12 @@ static int unpack_tlv_router_cap(enum isis_tlv_context context, if (length < SUBTLV_RANGE_LABEL_SIZE || length > SUBTLV_RANGE_INDEX_SIZE) { stream_forward_getp(s, length); - continue; + break; } /* RFC 8667 section #3.3: Only one SRLB is authorized */ if (rcap->srlb.range_size != 0) { stream_forward_getp(s, length); - continue; + break; } /* Ignore Flags which are not defined */ stream_getc(s); @@ -3072,10 +3102,27 @@ static int unpack_tlv_router_cap(enum isis_tlv_context context, /* Skip Type and get Length of SID Label */ stream_getc(s); size = stream_getc(s); - if (size == ISIS_SUBTLV_SID_LABEL_SIZE) + + if (size == ISIS_SUBTLV_SID_LABEL_SIZE + && length != SUBTLV_RANGE_LABEL_SIZE) { + stream_forward_getp(s, length - 6); + break; + } + + if (size == ISIS_SUBTLV_SID_INDEX_SIZE + && length != SUBTLV_RANGE_INDEX_SIZE) { + stream_forward_getp(s, length - 6); + break; + } + + if (size == ISIS_SUBTLV_SID_LABEL_SIZE) { rcap->srlb.lower_bound = stream_get3(s); - else + } else if (size == ISIS_SUBTLV_SID_INDEX_SIZE) { rcap->srlb.lower_bound = stream_getl(s); + } else { + stream_forward_getp(s, length - 6); + break; + } /* SRLB sanity checks. */ if (rcap->srlb.range_size == 0 @@ -3089,13 +3136,14 @@ static int unpack_tlv_router_cap(enum isis_tlv_context context, /* Only one range is supported. Skip subsequent one */ size = length - (size + SUBTLV_SR_BLOCK_SIZE); if (size > 0) - stream_forward_getp(s, length); + stream_forward_getp(s, size); + break; case ISIS_SUBTLV_NODE_MSD: /* Check that MSD is correctly formated */ if (length < MSD_TLV_SIZE) { stream_forward_getp(s, length); - continue; + break; } msd_type = stream_getc(s); rcap->msd = stream_getc(s); diff --git a/isisd/isis_tlvs.h b/isisd/isis_tlvs.h index 38470ef85..0c6ed11cb 100644 --- a/isisd/isis_tlvs.h +++ b/isisd/isis_tlvs.h @@ -447,6 +447,7 @@ enum ext_subtlv_size { /* RFC 8667 sections #2 & #3 */ ISIS_SUBTLV_SID_LABEL_SIZE = 3, + ISIS_SUBTLV_SID_INDEX_SIZE = 4, ISIS_SUBTLV_SID_LABEL_RANGE_SIZE = 9, ISIS_SUBTLV_ALGORITHM_SIZE = 4, ISIS_SUBTLV_ADJ_SID_SIZE = 5, # # Extracted: # diff --git a/tests/isisd/test_fuzz_isis_tlv_tests.h.gz b/tests/isisd/test_fuzz_isis_tlv_tests.h.gz # index accc906bf25853bd417cff25840b233f98d1221e..20b1dc33f9593661b8310dc0c205e68d022de480 100644 # GIT binary patch # literal 222652 # --- a/tests/isisd/test_fuzz_isis_tlv_tests.h +++ b/tests/isisd/test_fuzz_isis_tlv_tests.h @@ -1139,9 +1139,9 @@ { .input = "\xc1\x0d\x49\x10\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf2\x0c\xfd\xd4\x80\xf2\xff\xfc\x7f\x08\xf5\xeb\x0d\xee\x97\x01\xa1\xa5\x65\x80\xf2\xf0\xe7\x21\x04\x7f\xff\x08\xf5\x54\x54\xcc\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x64\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x34\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\xcc\x54\x54\x54\x54\x54\x54\x43\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1d\x00\x00\x00\x00\x00\x00\x00\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xde\xff\xff\xf6\x00\x00\x00\x00\x00\x00\x00\x80\xff\xff\xff\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x00\x00\x00\x80\xff\xff\xff\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2c\x30\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\xd8\xd8\xd8\xd8\xd8\x05\xff\xff\x05\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\xd8\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xf2\x00\x00\x10\xde\xff\xff\x00\x00\x00\x00\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x12", .input_len = 564, - .output = "\x43\x6f\x75\x6c\x64\x20\x6e\x6f\x74\x20\x75\x6e\x70\x61\x63\x6b\x20\x54\x4c\x56\x73\x3a\x0a\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x35\x36\x34\x20\x62\x79\x74\x65\x73\x20\x6f\x66\x20\x54\x4c\x56\x73\x2e\x2e\x2e\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x31\x39\x33\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x31\x33\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x31\x39\x33\x20\x28\x31\x33\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x32\x34\x32\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x31\x32\x2e\x0a\x20\x20\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x52\x6f\x75\x74\x65\x72\x20\x43\x61\x70\x61\x62\x69\x6c\x69\x74\x79\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x41\x76\x61\x69\x6c\x61\x62\x6c\x65\x20\x64\x61\x74\x61\x20\x31\x20\x74\x6f\x6f\x20\x73\x68\x6f\x72\x74\x20\x74\x6f\x20\x63\x6f\x6e\x74\x61\x69\x6e\x20\x61\x20\x54\x4c\x56\x20\x68\x65\x61\x64\x65\x72\x2e\x0a\x0a", - .output_len = 1415, - .ret = 2 + .output = "\x55\x6e\x70\x61\x63\x6b\x20\x6c\x6f\x67\x3a\x0a\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x35\x36\x34\x20\x62\x79\x74\x65\x73\x20\x6f\x66\x20\x54\x4c\x56\x73\x2e\x2e\x2e\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x31\x39\x33\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x31\x33\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x31\x39\x33\x20\x28\x31\x33\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x32\x34\x32\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x31\x32\x2e\x0a\x20\x20\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x52\x6f\x75\x74\x65\x72\x20\x43\x61\x70\x61\x62\x69\x6c\x69\x74\x79\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x57\x41\x52\x4e\x49\x4e\x47\x3a\x20\x52\x6f\x75\x74\x65\x72\x20\x43\x61\x70\x61\x62\x69\x6c\x69\x74\x79\x20\x73\x75\x62\x54\x4c\x56\x20\x6c\x65\x6e\x67\x74\x68\x20\x74\x6f\x6f\x20\x6c\x61\x72\x67\x65\x20\x63\x6f\x6d\x70\x61\x72\x65\x64\x20\x74\x6f\x20\x65\x78\x70\x65\x63\x74\x65\x64\x20\x73\x69\x7a\x65\x0a\x55\x6e\x70\x61\x63\x6b\x65\x64\x20\x54\x4c\x56\x73\x3a\x0a", + .output_len = 514, + .ret = 0 }, { @@ -1227,9 +1227,9 @@ { .input = "\x81\x0d\x49\x10\xff\xff\xff\x65\x0a\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x54\x54\x08\xf5\xeb\x0d\x97\x80\xf2\x0c\xfd\xd4\x80\xf2\xff\xfc\x7f\x08\xf5\xeb\x0d\xee\x97\x01\xa1\xa7\x65\x80\xf2\xf0\xf5\x21\x04\x7f\xff\x08\xf5\x54\x54\xcc\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x00\xfd\x0a\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x54\x54\x6b\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\xcc\x54\x54\x54\x54\x54\x54\x41\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x00\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1d\x00\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x54\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x00\x00\x00\x00\x2c\x2c\x2c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf6\x00\x0b\x00\x00\x00\x05\xff\xff\x05\x00\x00\x00\x00\x00\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x36\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x54\x54\x54\x54\x54\x00\x00\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x2c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xef\x00\x00\x00\x00\x00\x00\x00\x52\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xfb\x00\x00\x04\x00\x00\x00\x00\x00\xff\x00\x00\xff\xf2\x00\x00\x00\xde\xff\xff\x00\xff\xff\xff\xfe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf9\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00\x00\x00\x00\x00\x12", .input_len = 403, - .output = "\x43\x6f\x75\x6c\x64\x20\x6e\x6f\x74\x20\x75\x6e\x70\x61\x63\x6b\x20\x54\x4c\x56\x73\x3a\x0a\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x34\x30\x33\x20\x62\x79\x74\x65\x73\x20\x6f\x66\x20\x54\x4c\x56\x73\x2e\x2e\x2e\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x31\x32\x39\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x31\x33\x2e\x0a\x20\x20\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x50\x72\x6f\x74\x6f\x63\x6f\x6c\x73\x20\x53\x75\x70\x70\x6f\x72\x74\x65\x64\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x20\x20\x50\x72\x6f\x74\x6f\x63\x6f\x6c\x73\x20\x53\x75\x70\x70\x6f\x72\x74\x65\x64\x3a\x20\x37\x33\x2c\x20\x31\x36\x2c\x20\x32\x35\x35\x2c\x20\x32\x35\x35\x2c\x20\x32\x35\x35\x2c\x20\x31\x30\x31\x2c\x20\x31\x30\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x31\x31\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x31\x31\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x31\x31\x20\x28\x31\x31\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x32\x34\x32\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x31\x32\x2e\x0a\x20\x20\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x52\x6f\x75\x74\x65\x72\x20\x43\x61\x70\x61\x62\x69\x6c\x69\x74\x79\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x30\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x30\x20\x28\x30\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x30\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x32\x35\x35\x2e\x0a\x20\x20\x20\x20\x41\x76\x61\x69\x6c\x61\x62\x6c\x65\x20\x64\x61\x74\x61\x20\x39\x31\x20\x74\x6f\x6f\x20\x73\x68\x6f\x72\x74\x20\x66\x6f\x72\x20\x63\x6c\x61\x69\x6d\x65\x64\x20\x54\x4c\x56\x20\x6c\x65\x6e\x20\x32\x35\x35\x2e\x0a\x0a", - .output_len = 1176, - .ret = 2 + .output = "\x55\x6e\x70\x61\x63\x6b\x20\x6c\x6f\x67\x3a\x0a\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x34\x30\x33\x20\x62\x79\x74\x65\x73\x20\x6f\x66\x20\x54\x4c\x56\x73\x2e\x2e\x2e\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x31\x32\x39\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x31\x33\x2e\x0a\x20\x20\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x50\x72\x6f\x74\x6f\x63\x6f\x6c\x73\x20\x53\x75\x70\x70\x6f\x72\x74\x65\x64\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x20\x20\x50\x72\x6f\x74\x6f\x63\x6f\x6c\x73\x20\x53\x75\x70\x70\x6f\x72\x74\x65\x64\x3a\x20\x37\x33\x2c\x20\x31\x36\x2c\x20\x32\x35\x35\x2c\x20\x32\x35\x35\x2c\x20\x32\x35\x35\x2c\x20\x31\x30\x31\x2c\x20\x31\x30\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x31\x31\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x31\x31\x2e\x0a\x20\x20\x20\x20\x53\x6b\x69\x70\x70\x69\x6e\x67\x20\x75\x6e\x6b\x6e\x6f\x77\x6e\x20\x54\x4c\x56\x20\x31\x31\x20\x28\x31\x31\x20\x62\x79\x74\x65\x73\x29\x0a\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x46\x6f\x75\x6e\x64\x20\x54\x4c\x56\x20\x6f\x66\x20\x74\x79\x70\x65\x20\x32\x34\x32\x20\x61\x6e\x64\x20\x6c\x65\x6e\x20\x31\x32\x2e\x0a\x20\x20\x20\x20\x55\x6e\x70\x61\x63\x6b\x69\x6e\x67\x20\x52\x6f\x75\x74\x65\x72\x20\x43\x61\x70\x61\x62\x69\x6c\x69\x74\x79\x20\x54\x4c\x56\x2e\x2e\x2e\x0a\x20\x20\x20\x20\x57\x41\x52\x4e\x49\x4e\x47\x3a\x20\x52\x6f\x75\x74\x65\x72\x20\x43\x61\x70\x61\x62\x69\x6c\x69\x74\x79\x20\x73\x75\x62\x54\x4c\x56\x20\x6c\x65\x6e\x67\x74\x68\x20\x74\x6f\x6f\x20\x6c\x61\x72\x67\x65\x20\x63\x6f\x6d\x70\x61\x72\x65\x64\x20\x74\x6f\x20\x65\x78\x70\x65\x63\x74\x65\x64\x20\x73\x69\x7a\x65\x0a\x55\x6e\x70\x61\x63\x6b\x65\x64\x20\x54\x4c\x56\x73\x3a\x0a\x50\x72\x6f\x74\x6f\x63\x6f\x6c\x73\x20\x53\x75\x70\x70\x6f\x72\x74\x65\x64\x3a\x20\x37\x33\x2c\x20\x31\x36\x2c\x20\x32\x35\x35\x2c\x20\x32\x35\x35\x2c\x20\x32\x35\x35\x2c\x20\x31\x30\x31\x2c\x20\x31\x30\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x2c\x20\x31\x31\x0a", + .output_len = 586, + .ret = 0 }, {