<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/111818>111818</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
[SPIR-V] Heap Use-After-Free in SPIRVEmitIntrinsics.cpp after 8bc8b84225765 commit
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
bwlodarcz
</td>
</tr>
</table>
<pre>
### Reproducer
Build LLVM with ASAN.
Run:
```
llc --verify-machineinstrs --spv-emit-nonsemantic-debug-info --spirv-ext=+SPV_KHR_non_semantic_info --print-after=spirv-nonsemantic-debug-info -O0 -mtriple=spirv64-unknown-unknown llvm/test/CodeGen/SPIRV/debug-info/debug-type-pointer.ll -o - 2>&1
```
### What's happening
The memory is freed in method `SPIRVEmitIntrinsics::visitAllocaInst(llvm::AllocaInst&)` by ` I.eraseFromParent();` in llvm/lib/Target/SPIRV/SPIRVEmitIntrinsics.cpp:1382.
After that accessed in method `SPIRVEmitIntrinsics::postprocessTypes()` by
```
1776 for (auto IB = PostprocessWorklist.rbegin(), IE = PostprocessWorklist.rend();
1777 IB != IE; ++IB) {
1778 CallInst *AssignCI = GR->findAssignPtrTypeInstr(*IB);
1779 Type *KnownTy = GR->findDeducedElementType(*IB);
1780 if (!KnownTy || !AssignCI || !isa<Instruction>(AssignCI->getArgOperand(0)))
1781 continue;
1782 // Try to improve the type deduced after all Functions are processed.
1783 if (auto *CI = dyn_cast<CallInst>(*IB)) {
```
The instruction from line 1783 is a culprit.
Summarizing the problem the `SmallVector<Instruction *> PostprocessWorklist` is storing `Instruction *` and other methods free them afterwards. In the final iteration the access of the pointers is UAF memory issue for these cases.
### Full listing
```
==3674043==ERROR: AddressSanitizer: heap-use-after-free on address 0x783c3c821be0 at pc 0x5964b098f439 bp 0x7ffd1f724a20 sp 0x7ffd1f724a18
READ of size 1 at 0x783c3c821be0 thread T0
#0 0x5964b098f438 in llvm::Value::getValueID() const <truncated>llvm-project/llvm/include/llvm/IR/Value.h:533:12
#1 0x5964b0c87cf0 in llvm::Instruction::getOpcode() const <truncated>llvm-project/llvm/include/llvm/IR/Instruction.h:274:39
#2 0x5964b0c87bd3 in llvm::CallInst::classof(llvm::Instruction const*) <truncated>llvm-project/llvm/include/llvm/IR/Instructions.h:1557:15
#3 0x5964b0c87b10 in llvm::isa_impl<llvm::CallInst, llvm::Instruction, void>::doit(llvm::Instruction const&) <truncated>llvm-project/llvm/include/llvm/Support/Casting.h:64:53
#4 0x5964b0c87ab1 in llvm::isa_impl_cl<llvm::CallInst, llvm::Instruction const*>::doit(llvm::Instruction const*) <truncated>llvm-project/llvm/include/llvm/Support/Casting.h:110:12
#5 0x5964b0c87841 in llvm::isa_impl_wrap<llvm::CallInst, llvm::Instruction const*, llvm::Instruction const*>::doit(llvm::Instruction const* const&) <truncated>llvm-project/llvm/include/llvm/Support/Casting.h:137:12
#6 0x5964b0c87776 in llvm::isa_impl_wrap<llvm::CallInst, llvm::Instruction* const, llvm::Instruction const*>::doit(llvm::Instruction* const&) <truncated>llvm-project/llvm/include/llvm/Support/Casting.h:127:12
#7 0x5964b0c87553 in llvm::CastIsPossible<llvm::CallInst, llvm::Instruction*, void>::isPossible(llvm::Instruction* const&) <truncated>llvm-project/llvm/include/llvm/Support/Casting.h:255:12
#8 0x5964b0c872f5 in llvm::CastInfo<llvm::CallInst, llvm::Instruction*, void>::doCastIfPossible(llvm::Instruction* const&) <truncated>llvm-project/llvm/include/llvm/Support/Casting.h:493:10
#9 0x5964b0c86d2c in decltype(auto) llvm::dyn_cast<llvm::CallInst, llvm::Instruction>(llvm::Instruction*) <truncated>llvm-project/llvm/include/llvm/Support/Casting.h:663:10
#10 0x5964b275bfed in (anonymous namespace)::SPIRVEmitIntrinsics::postprocessTypes() <truncated>llvm-project/llvm/lib/Target/SPIRV/SPIRVEmitIntrinsics.cpp:1783:20
#11 0x5964b2753236 in (anonymous namespace)::SPIRVEmitIntrinsics::runOnModule(llvm::Module&) <truncated>llvm-project/llvm/lib/Target/SPIRV/SPIRVEmitIntrinsics.cpp:1827:14
#12 0x5964ba1818ed in (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) <truncated>llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1523:27
#13 0x5964ba17f787 in llvm::legacy::PassManagerImpl::run(llvm::Module&) <truncated>llvm-project/llvm/lib/IR/LegacyPassManager.cpp:541:44
#14 0x5964ba1ace05 in llvm::legacy::PassManager::run(llvm::Module&) <truncated>llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1650:14
#15 0x5964b069ede3 in compileModule(char**, llvm::LLVMContext&) <truncated>llvm-project/llvm/tools/llc/llc.cpp:753:8
#16 0x5964b069428a in main <truncated>llvm-project/llvm/tools/llc/llc.cpp:412:22
#17 0x7b8c3d82a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#18 0x7b8c3d82a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#19 0x5964b059dca4 in _start (<truncated>llvm-project/build-debug/bin/llc+0x1b9a8ca4)
0x783c3c821be0 is located 32 bytes inside of 112-byte region [0x783c3c821bc0,0x783c3c821c30)
freed by thread T0 here:
#0 0x5964b06805ad in operator delete(void*) <truncated>llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:143:3
#1 0x5964ba605b05 in llvm::User::operator delete(void*) <truncated>llvm-project/llvm/lib/IR/User.cpp:208:5
#2 0x5964ba60f670 in llvm::UnaryInstruction::operator delete(void*) <truncated>llvm-project/llvm/include/llvm/IR/InstrTypes.h:70:37
#3 0x5964ba60c85b in llvm::Value::deleteValue() <truncated>llvm-project/llvm/include/llvm/IR/Instruction.def:171:1
#4 0x5964b9643600 in llvm::ilist_alloc_traits<llvm::Instruction>::deleteNode(llvm::Instruction*) <truncated>llvm-project/llvm/include/llvm/IR/Instruction.h:1046:6
#5 0x5964b964348c in llvm::iplist_impl<llvm::simple_ilist<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>, llvm::SymbolTableListTraits<llvm::Instruction, llvm::ilist_iterator_bits<true>, llvm::ilist_parent<llvm::BasicBlock>>>::erase(llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>) <truncated>llvm-project/llvm/include/llvm/ADT/ilist.h:205:5
#6 0x5964b9f764e0 in llvm::Instruction::eraseFromParent() <truncated>llvm-project/llvm/lib/IR/Instruction.cpp:94:37
#7 0x5964b27f9cd9 in (anonymous namespace)::SPIRVEmitIntrinsics::visitAllocaInst(llvm::AllocaInst&) <truncated>llvm-project/llvm/lib/Target/SPIRV/SPIRVEmitIntrinsics.cpp:1382:5
#8 0x5964b27f02b4 in llvm::InstVisitor<(anonymous namespace)::SPIRVEmitIntrinsics, llvm::Instruction*>::visitAlloca(llvm::AllocaInst&) <truncated>llvm-project/llvm/include/llvm/IR/Instruction.def:171:1
#9 0x5964b2776da4 in llvm::InstVisitor<(anonymous namespace)::SPIRVEmitIntrinsics, llvm::Instruction*>::visit(llvm::Instruction&) <truncated>llvm-project/llvm/include/llvm/IR/Instruction.def:171:1
#10 0x5964b275a3fc in (anonymous namespace)::SPIRVEmitIntrinsics::runOnFunction(llvm::Function&) <truncated>llvm-project/llvm/lib/Target/SPIRV/SPIRVEmitIntrinsics.cpp:1737:9
#11 0x5964b2752a35 in (anonymous namespace)::SPIRVEmitIntrinsics::runOnModule(llvm::Module&) <truncated>llvm-project/llvm/lib/Target/SPIRV/SPIRVEmitIntrinsics.cpp:1815:16
#12 0x5964ba1818ed in (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) <truncated>llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1523:27
#13 0x5964ba17f787 in llvm::legacy::PassManagerImpl::run(llvm::Module&) <truncated>llvm-project/llvm/lib/IR/LegacyPassManager.cpp:541:44
#14 0x5964ba1ace05 in llvm::legacy::PassManager::run(llvm::Module&) <truncated>llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1650:14
#15 0x5964b069ede3 in compileModule(char**, llvm::LLVMContext&) <truncated>llvm-project/llvm/tools/llc/llc.cpp:753:8
#16 0x5964b069428a in main <truncated>llvm-project/llvm/tools/llc/llc.cpp:412:22
#17 0x7b8c3d82a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#18 0x7b8c3d82a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#19 0x5964b059dca4 in _start (<truncated>llvm-project/build-debug/bin/llc+0x1b9a8ca4)
previously allocated by thread T0 here:
#0 0x5964b067fd4d in operator new(unsigned long) <truncated>llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:86:3
#1 0x5964ba60350a in llvm::User::allocateFixedOperandUser(unsigned long, unsigned int, unsigned int) <truncated>llvm-project/llvm/lib/IR/User.cpp:145:7
#2 0x5964ba60350a in llvm::User::operator new(unsigned long, llvm::User::IntrusiveOperandsAllocMarker) <truncated>llvm-project/llvm/lib/IR/User.cpp:161:10
#3 0x5964b0cb3a90 in llvm::UnaryInstruction::operator new(unsigned long) <truncated>llvm-project/llvm/include/llvm/IR/InstrTypes.h:69:41
#4 0x5964c607445e in llvm::LLParser::parseAlloc(llvm::Instruction*&, llvm::LLParser::PerFunctionState&) <truncated>llvm-project/llvm/lib/AsmParser/LLParser.cpp:8163:20
#5 0x5964c605af2f in llvm::LLParser::parseInstruction(llvm::Instruction*&, llvm::BasicBlock*, llvm::LLParser::PerFunctionState&) <truncated>llvm-project/llvm/lib/AsmParser/LLParser.cpp:7050:12
#6 0x5964c6053bc1 in llvm::LLParser::parseBasicBlock(llvm::LLParser::PerFunctionState&) <truncated>llvm-project/llvm/lib/AsmParser/LLParser.cpp:6701:13
#7 0x5964c5fbc0d1 in llvm::LLParser::parseFunctionBody(llvm::Function&, unsigned int, llvm::ArrayRef<unsigned int>) <truncated>llvm-project/llvm/lib/AsmParser/LLParser.cpp:6623:9
#8 0x5964c5fa8b4f in llvm::LLParser::parseDefine() <truncated>llvm-project/llvm/lib/AsmParser/LLParser.cpp:762:10
#9 0x5964c5f88b2c in llvm::LLParser::parseTopLevelEntities() <truncated>llvm-project/llvm/lib/AsmParser/LLParser.cpp:566:11
#10 0x5964c5f875c8 in llvm::LLParser::Run(bool, llvm::function_ref<std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>> (llvm::StringRef, llvm::StringRef)>) <truncated>llvm-project/llvm/lib/AsmParser/LLParser.cpp:94:10
#11 0x5964c6181208 in parseAssemblyInto(llvm::MemoryBufferRef, llvm::Module*, llvm::ModuleSummaryIndex*, llvm::SMDiagnostic&, llvm::SlotMapping*, bool, llvm::function_ref<std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>> (llvm::StringRef, llvm::StringRef)>) <truncated>llvm-project/llvm/lib/AsmParser/Parser.cpp:35:8
#12 0x5964c6180b1d in llvm::parseAssemblyInto(llvm::MemoryBufferRef, llvm::Module*, llvm::ModuleSummaryIndex*, llvm::SMDiagnostic&, llvm::SlotMapping*, llvm::function_ref<std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>> (llvm::StringRef, llvm::StringRef)>) <truncated>llvm-project/llvm/lib/AsmParser/Parser.cpp:42:10
#13 0x5964c61816cd in llvm::parseAssembly(llvm::MemoryBufferRef, llvm::SMDiagnostic&, llvm::LLVMContext&, llvm::SlotMapping*, llvm::function_ref<std::optional<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>> (llvm::StringRef, llvm::StringRef)>) <truncated>llvm-project/llvm/lib/AsmParser/Parser.cpp:53:7
#14 0x5964ba84d6ed in llvm::parseIR(llvm::MemoryBufferRef, llvm::SMDiagnostic&, llvm::LLVMContext&, llvm::ParserCallbacks) <truncated>llvm-project/llvm/lib/IRReader/IRReader.cpp:89:10
#15 0x5964ba84eb43 in llvm::parseIRFile(llvm::StringRef, llvm::SMDiagnostic&, llvm::LLVMContext&, llvm::ParserCallbacks) <truncated>llvm-project/llvm/lib/IRReader/IRReader.cpp:105:10
#16 0x5964b0699c3a in compileModule(char**, llvm::LLVMContext&) <truncated>llvm-project/llvm/tools/llc/llc.cpp:571:11
#17 0x5964b069428a in main <truncated>llvm-project/llvm/tools/llc/llc.cpp:412:22
#18 0x7b8c3d82a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#19 0x7b8c3d82a28a in __libc_start_main csu/../csu/libc-start.c:360:3
#20 0x5964b059dca4 in _start (<truncated>llvm-project/build-debug/bin/llc+0x1b9a8ca4)
SUMMARY: AddressSanitizer: heap-use-after-free <truncated>llvm-project/llvm/include/llvm/IR/Value.h:533:12 in llvm::Value::getValueID() const
Shadow bytes around the buggy address:
0x783c3c821900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
0x783c3c821980: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
0x783c3c821a00: fd fd fd fd fa fa fa fa fa fa fa fa fd fd fd fd
0x783c3c821a80: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
0x783c3c821b00: fa fa fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x783c3c821b80: fa fa fa fa fa fa fa fa fd fd fd fd[fd]fd fd fd
0x783c3c821c00: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fd fd
0x783c3c821c80: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
0x783c3c821d00: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00
0x783c3c821d80: 00 00 fa fa fa fa fa fa fa fa 00 00 00 00 00 00
0x783c3c821e00: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==3674043==ABORTING
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzsXN9zm76y_2vIi8YZED_9kAfbiXs8J_k2k6Q9c588Qghbt7LESCKJ-9ffkcAYDE7iJmnvmWnH4xixrPazq13tLlCkFF1xQi6ccOqEl2eo1GshL9InJjIk8c-zVGTbCwf61QfckUKKrMREOu6l406mJWUZuL7-fgOeqF6Dyf3kn_Pq1F3JHX9S_XYit_7YQ8YwGI0eiaT5drRBeE05oVxpqcBopIrHEdlQPeKCK7JBXFM8ykharkaU58JSUPk4Is_a8S8dOL2__b7897_ullzw5e6CZU1aSMr1COWaSMe_rC48xverC0YbLWnByI42CkYl_8HFE9_9BYw9bhw410RpB85nIiNfCHfg_P52cffdgfM9x-ZAbwsyKgTlmshzxsBIgBGAjn_lwMgbVFD93aj9P2ukHRgrsEZFQTjlq4riYU3AhmyE3AKqQC4JyQDlYEP0WmTAiVwr1dWG6gXXknJFsTJG8SePVFE9YUxgtOAGSmKB2XPt4ciBYydyQbo17MDinEikyFyKzS2ShJsLDYU_NWdpox5GUwfOH5BcEd1SzoA457goHH_i-QmsF87EWAvoNdIAYUyUejOoQihdSGGuedgWRNXC1eIPKRoA4MVxBADIhQQOTFCpBVhMgeNfgts9u_8I-YNRpc9lSlaU14zhDCyujpMSnu3VU03nxXEM6n9mFuiZqxdXjm8Opg6cLqYOHAMnnrYFTOwFM8SYsQpw4GRiHXe2sLN_uRs5_lVOeVYN32pp8BtaaSWYWK57MSzTsWVqCA3Df5vV_bA94HdJjLNnV4xsCNeG9ii_xLX8aA4sidcwjGdOPDNQ9zI3Q1Qhx59ZQUusqeDWK5IdpRFjRfRErr4WRCKrT9dq3n5ak3u1UrHgmvKStFWeQHvKgXMHzsGD3AItAN0UUjwSoNcEGAcFWQUV2GABEGNgXnIrkwJIElCbl2Tn7Xn9Fmi7dhw4qa2SbfkSI6Udf7azXIWu0V_b0AcL03g23asF5FJsAKOcVJNSBRDAJSsk1eftmHFfbjZI0p-Uryy0QoqUkY39bVxngxj7TrAWsqt3I7fjXw0tZOvZCigtpOHqRO7hdZELEM-A0Gsiaz-topGZdlNp9AnJTJ2DBbei5JQjBqgmElkuZqxydiDySvAqXioz9bfJfB_mVEmss-o1UQRgpIg6H46a85IxYBA08fIwzPqXjn_pR3HgBn51cHV39_XO8SdgkmWSKHWPONX0p9k-JmBNUDEqFak2lJFFKDhAFSlwn-PExz5OoJcSFyANCgzc53AcBak7TvLAH4O0MGR5nnl5DAMEXaC6I15Sb59Xk0ujC0V_EuAZZgfs9VoSlIGHfSQDDvTd7oRJE5NtgPyOmHEN83NFtD1aXFYxyniOCS3-TMuSY6RJ5vhX5tJRIcX_EmzieB3dKceszMh-YHHnwLlld752_Eno-yakw45kXiMZTmKcu13JOiGglu9rgUVGPkq81gxWSBgHjj_xxx0hYVvINPO7Qu7d2BxhhpQSeWfrbHuGldi4h3HzD5FbWcG9MIztn47kfkdy70C9VKEl3RTM8WcDcODsiCXgDDwKaiSuzmWC6tfwRr-O974sCiFtXoWs11q8UWCXVAdt0EaLUm8Y7RKfCHhvs1MQv8PCw4g9z-37T9iGnATHID9JVPwq6A9Wy6etCM-P-_qJ2voxOd1H6aeF5EP086magQOaiduaCcNeUFN6oW6FUjQ1lc-JqunFCLrn9QcUAMOwr4CkrQCYhwMKMPXau6FnwvLK_6QCgrHde7tZwbilgCiD2CggI5jpKqE3iauRYy9sK3c9RSc2vT2urg_eF6IBpF6TAME4TPOqdDQQueDbjSgV4GhDVIEwsRWMEfPEevJtIE6vgOPE4IE7PAaM1wLjmxD3DjCy5F_5jcjKg3W5G3r7SjwdWlKFpaAFrcm0kJd4yZvsdHN7i5S6QRytbD7-CaBsxnVNVghvW3PtYITQWijurjh_jyTO4yTuRhdmmVW_WywXNhmrIXy-6GHgmdgQdCUP9pIjTNzwTZL_Rqm9KHTb66YWe58JRWOSEbufYbEpKCPNUsBrJG3MOchqrq-_38wE1-T5pOCrhWDKHuLqu5YwDs2KSLryRS35Apgg271CZn2_Z6rAg2bxHRRVZm-P0wT7WQKRh8dmruWS0RQvlUZSLzFibGlnx6p04Pz83IFztVUZKcwsvNCsMkbvgqqUS6wdupMm7UlrgJ1JD-erfhqCkSU4x6b0ioxxu3m9t9-pwnGGUWBZ22tsW-lFBaYlZVnV0jVHlO-0OHWfvXSMEoyCpm1UfR_U1FQBJix34EOQbjVRwESyjJhS3PPgyIwBSVa29RFO29dj14Gz1gD23Wa2qjWbbvdVO1gTSZoGea96jxI3RDYoioJIpIUEGWFEm7Vtc4637Ke1U8iR3Tsrh0MK8frPkpOnZcV153CB3zJJu2hHkRumhxHim9qFg3cI2Q8Hhm0tEHTN-guHa3QUuXkUH1S63ziS21434f3yvVCc29zAektsV3Q8XJijyMVJmB7tyFSiVQMnJBqvdzsyktv8wmwB3nAZPY4CP3IPmwaMKr1EjAm81BJRrTrp4EHi18LwT9W2-fhEcLCR47lBZNLB4WrZIAsSfICssNB6HRFlRsjSAj-KtbOfVDqqGplCLtNKSVoao14NkRbVbZM28ylSFE-ZwD-sHg8uu99uUsEeUMrINVX64WVDfL5wO1PbG0EdKx9M97Sb8JAiIxrROvvhIiNLUdju1kugrNBwBnLEFGkKr9aJYxK3r6l-mMFfXYCTywczbO_v2HLTDXvxqdn-x3kcBeS1RufgDbWTY2bbKarQOQ76sSje1xP5GGfj99QTp9xB_Ky6wk9gS_3tSh_GuQvToK_770Zse_fjF4C_1AzY-UVLLx-gk_dE9_FeGXGUoT-mjONbwe_RQ6cngPwcv7uM3t0Z7CDbD37mko9t73N8pEkAkR_-1zYJvLBda_xtEvxtEvxtEvxtEvz5JkEhySMVpWJbYIsh2x84pZaP8yzo1vKcPDkwKbl9-i4DTPDVJ5TzSXS8mvdDFx2r5nco5_SZZPWTN_ZsT-QZaAYo1_3jdxX_XmA2hPho8f8ShJc1PRu8xmxJpaKPpIasbMp2g-QPA_19UCKvf6-idcs-9dH4tEbGL62gU3oZ0djGk8F-AY7cOAhC0pX4-voWyUabhfltNfhiKyA6DL1tHrdE7rKqe430L2wdE7WpGcL5jvfOO7yoc8Ol2zjAkRuiHOavQuwAejvQVpXa335-mw5iNxx41CBq6cBPsfeqDtpgkj8CJIpd62H-YL2LwzzFbvY6kJ2AU5Ftjyf3_ajXKvOkRNs7U4vMOkQndB1eBxvZHHM8eJMbhzlK0uD1hXtJcspPajW-vpwiePzmMw7zJEkhflWwB1Fck0fCrrimmv7KbdcXRAyjyD5hM1whGhnjECcvyXhns9pUCNa1fF4vkaW01lc624VsM4pYe2y5xM_PnlcdpMZ7lsrUQyvHn1VZ6Qw0xGZg34C1p6vGVkNRb9i2kt-dtx_QWcT3dgqzOLsdxv3w-EPXqW1BHd6g95rg4iUedK2qq71CKbJJ2XbBteiWDfbRz2mZ50T2hN8l85Oh4epp2O2CZ-S5R3J_c0nRigulKe6F53sm9A0qCmOS6sK_Bh8weMfcftgvc2DL2m7qZV3H-m-w-197H7N3MBDsm0aHde8Iv2Twtxv7RZMdVut_zflr5rRdivhY8ycJsogMWdPUDp9ux0rQGWIsRfiHOrkauyMos4h3P3c1wHhgCYct0CQN_EHQc3rQTTxmrP9vkD17y-oQc7sdNcY--oPtsrBq4Xv9Htbv6pclf6JfNv60fhl0f2-_7P7bzc3k7n9OeYvmQ187OfGdl1roNcrEU_3MD5Ki5Jl9DyktV6vt7hWffY-v9ZzP2DUqB3n25g8CORrgk1R8UO_zErc-HzQgT5_nIecBPslbcB3y7PNJ3Taut2qp9YbWVZvZUSX1AIVT83V5HCA-ariXuA_weZOiDjn3-WRuD5vrvvoZ4FPJUxEcw_IGPsRt8Tn4HFUR6rkTYGRFeGZCjeAEqNYZSQpJFOFagQSgomAUV-8DWjes7-lVctWRBNl3FCZg_6-RHNwiqSlirHHXHbHrARcC1wduANwQuBFwmzznXwQVgJFcA0myn4K3uDc2AnP7-J4JXPWzfy2i3YK41wj_GOaUN3tZRbSh2cBssEsk6WrdY5X7XaLqZVVJdCn3MuVhl6hUpCZUWBSWV96UaV-YSBHri2P4jA-IKKcaCJlVcbwm2m1jt4Iqwas7I6Vqk4C80bZJExDlRALxSGTOxNNearwjsi00gIX4QQ9sDVBDtOBaIiBSs0UcSJ-mDad7xIF9j9Tm8xOQk92pa2OoKg8_BI8bu99ZG_SpcHr0BdLJ9Ovdw-KfL4MvnJ5lF3429sfojFx4MUzCyPNhfLa-iKMszzIvTAiEY5ckXu7nYRK5IU7zFI7JGb2ALgw813M9LwxhfJ5ijPM4DwgOwwxFnhO4ZIMoOzc737mQqzP7quyF53mJl5wxlBKm7H_zACEnT9WLtA6ETnh5Ji_shpuWK-UELqNKqz0bTTWz_z_E_e3ibvTdCS8rn_mmyMi-qj8y3mH23CP39uu1l6Q4SZMAwjCOQpNbbqg-KyW7WGtd2J3Vvp-9onpdpudYbFopbTcdsKKbPKvG9ngB_y8AAP__7yZ7VA">