Out-of-bounds write in AST parser

[guidovranken]

Crash report

Reported by OSS-Fuzz (issue 58510).

Reproducer:

import ast
ast.parse(bytes([
  0x46, 0x22, 0x76, 0x76, 0x3a, 0x6f, 0x72, 0x3a, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x77, 0x72, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x78, 0x3a, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a,
  0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46,
  0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b,
  0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20,
  0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77,
  0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x2d, 0x7b, 0x75, 0x74, 0x66, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a,
  0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22,
  0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73,
  0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d, 0x7b, 0x22, 0x7b, 0x22,
  0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76,
  0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x77, 0x76,
  0x3a, 0x3a, 0x20, 0x74, 0x61, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x2d,
  0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22, 0x76, 0x3a, 0x2e, 0x7b, 0x22, 0x7b,
  0x22, 0x46, 0x22, 0x76, 0x3a, 0x2d, 0x7b, 0x22, 0x7b, 0x22, 0x46, 0x22,
  0x76, 0x3a, 0x77, 0x76, 0x3a, 0x3a, 0x20, 0x73, 0x61, 0x2d, 0x7b, 0xa7,
  0x61, 0x2d, 0xf3, 0xa0, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa1, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x82, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa1, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81,
  0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3,
  0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81,
  0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5,
  0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0x81, 0xb5, 0xf3, 0xa0,
  0x81, 0x81, 0xb5, 0xf3, 0xa0, 0x81, 0xa7, 0x7b, 0x15, 0x7b, 0xc0, 0xad,
  0x7b, 0x7b, 0xc0, 0xad, 0x7b, 0x22]))

Regression range: ece20db...6be7aee

Error messages

AddressSanitizer stack trace:

==2936==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62a0000b91f4 at pc 0x000000c0a818 bp 0x7ffc21dc1e30 sp 0x7ffc21dc1e28
WRITE of size 1 at 0x62a0000b91f4 thread T0
SCARINESS: 31 (1-byte-write-heap-buffer-overflow)
    #0 0xc0a817 in tok_get_normal_mode cpython/Parser/tokenizer.c:2240:41
    #1 0xbf81d5 in tok_get cpython/Parser/tokenizer.c:2676:16
    #2 0xbf81d5 in _PyTokenizer_Get cpython/Parser/tokenizer.c:2685:18
    #3 0xb46ffa in _PyPegen_tokenize_full_source_to_check_for_errors cpython/Parser/pegen_errors.c:171:17
    #4 0xb46c26 in _Pypegen_set_syntax_error cpython/Parser/pegen_errors.c:0
    #5 0xb4313c in _PyPegen_run_parser cpython/Parser/pegen.c:858:9
    #6 0xb43a4d in _PyPegen_run_parser_from_string cpython/Parser/pegen.c:952:14
    #7 0xbf4ec7 in _PyParser_ASTFromString cpython/Parser/peg_api.c:14:21
    #8 0x95dab9 in Py_CompileStringObject cpython/Python/pythonrun.c:1771:11
    #9 0x7d8af6 in builtin_compile_impl cpython/Python/bltinmodule.c:831:14
    #10 0x7d8af6 in builtin_compile cpython/Python/clinic/bltinmodule.c.h:383:20
    #11 0xca3720 in cfunction_vectorcall_FASTCALL_KEYWORDS cpython/Objects/methodobject.c:438:24
    #12 0x5c1b88 in _PyObject_VectorcallTstate cpython/Include/internal/pycore_call.h:92:11
    #13 0x5c1b88 in PyObject_Vectorcall cpython/Objects/call.c:301:12
    #14 0x7f427f in _PyEval_EvalFrameDefault cpython/Python/bytecodes.c:2577:19
    #15 0x7e2a1f in _PyEval_EvalFrame cpython/Include/internal/pycore_ceval.h:88:16
    #16 0x7e2a1f in _PyEval_Vector cpython/Python/ceval.c:1529:12
    #17 0x5c261e in _PyFunction_Vectorcall cpython/Objects/call.c:0
    #18 0x5c193f in _PyVectorcall_Call cpython/Objects/call.c:247:16
    #19 0x5c1f22 in _PyObject_Call cpython/Objects/call.c:330:16
    #20 0x5c2a23 in PyObject_CallObject cpython/Objects/call.c:454:12
    #21 0x593bc4 in LLVMFuzzerTestOneInput python-library-fuzzers/fuzzer.cpp:134:14
    #22 0x461943 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15
    #23 0x44d0a2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6
    #24 0x45294c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9
    #25 0x47be82 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #26 0x7eafaded4082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/libc-start.c:308:16
    #27 0x44326d in _start
0x62a0000b91f4 is located 4 bytes to the right of 20464-byte region [0x62a0000b4200,0x62a0000b91f0)
allocated by thread T0 here:
    #0 0x552ad6 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:69:3
    #1 0x68ee29 in _PyMem_RawMalloc cpython/Objects/obmalloc.c:42:12
    #2 0x691e7a in PyMem_Malloc cpython/Objects/obmalloc.c:587:12
    #3 0xbf580a in tok_new cpython/Parser/tokenizer.c:74:49
    #4 0xbf580a in _PyTokenizer_FromString cpython/Parser/tokenizer.c:884:29
    #5 0xb43752 in _PyPegen_run_parser_from_string cpython/Parser/pegen.c:929:15
    #6 0xbf4ec7 in _PyParser_ASTFromString cpython/Parser/peg_api.c:14:21
    #7 0x95dab9 in Py_CompileStringObject cpython/Python/pythonrun.c:1771:11
    #8 0x7d8af6 in builtin_compile_impl cpython/Python/bltinmodule.c:831:14
    #9 0x7d8af6 in builtin_compile cpython/Python/clinic/bltinmodule.c.h:383:20
    #10 0xca3720 in cfunction_vectorcall_FASTCALL_KEYWORDS cpython/Objects/methodobject.c:438:24
    #11 0x5c1b88 in _PyObject_VectorcallTstate cpython/Include/internal/pycore_call.h:92:11
    #12 0x5c1b88 in PyObject_Vectorcall cpython/Objects/call.c:301:12
    #13 0x7f427f in _PyEval_EvalFrameDefault cpython/Python/bytecodes.c:2577:19
    #14 0x7e2a1f in _PyEval_EvalFrame cpython/Include/internal/pycore_ceval.h:88:16
    #15 0x7e2a1f in _PyEval_Vector cpython/Python/ceval.c:1529:12
    #16 0x5c261e in _PyFunction_Vectorcall cpython/Objects/call.c:0
    #17 0x5c193f in _PyVectorcall_Call cpython/Objects/call.c:247:16
    #18 0x5c1f22 in _PyObject_Call cpython/Objects/call.c:330:16
    #19 0x5c2a23 in PyObject_CallObject cpython/Objects/call.c:454:12
    #20 0x593bc4 in LLVMFuzzerTestOneInput python-library-fuzzers/fuzzer.cpp:134:14
    #21 0x461943 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:611:15
    #22 0x44d0a2 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:324:6
    #23 0x45294c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:860:9
    #24 0x47be82 in main /src/llvm-project/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #25 0x7eafaded4082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/libc-start.c:308:16

Your environment

Linux x64, latest cpython main branch checkout.

Linked PRs

• gh-104016: Fixed off by 1 error in f string tokenizer #104047
• gh-104016: Skip test for deeply neste f-strings on wasi #104071

[alex]

I'm guessing this is related to 1ef61cf and d4aa857

cc: @pablogsal, @lysnikolaou, @isidentical, @mgmacias95, @sunmy2019

[sunmy2019]

The overflow should be caught by an assert.

cpython/Parser/tokenizer.c

Lines 49 to 53 in 7d3931e

	static inline tokenizer_mode* TOK_NEXT_MODE(struct tok_state* tok) {
	assert(tok->tok_mode_stack_index >= 0);
	assert(tok->tok_mode_stack_index < MAXLEVEL);
	return &(tok->tok_mode_stack[++tok->tok_mode_stack_index]);
	}

Should be

-     assert(tok->tok_mode_stack_index < MAXLEVEL); 
+     assert(tok->tok_mode_stack_index + 1 < MAXLEVEL); 

Some code paths do not guard tok->tok_mode_stack_index.

[sunmy2019]

The tok->level checks on reading ( or {, while f" increases on tok->tok_mode_stack_index. Adding one more check here should solve the problem.

Simplified test case:

import ast
ast.parse('f"{1 1:' + ('{f"1:' * 199))

By the way, OSS-Fuzz is amazing at finding bugs! It's just hard to solve them. 😢

[guidovranken]

OSS-Fuzz has detected this as being fixed, so closing this issue.

[pablogsal]

Thanks a lot for opening the issue!

Btw, @guidovranken there is any place where we can keep track of the OSS-Fuzz detections/tickets?