diff --git a/crypto/heimdal/lib/asn1/Makefile.am b/crypto/heimdal/lib/asn1/Makefile.am
--- a/crypto/heimdal/lib/asn1/Makefile.am
+++ b/crypto/heimdal/lib/asn1/Makefile.am
@@ -37,6 +37,7 @@
 gen_files_pkcs12 = asn1_pkcs12_asn1.x
 gen_files_pkcs8 = asn1_pkcs8_asn1.x
 gen_files_pkcs9 = asn1_pkcs9_asn1.x
+gen_files_test_template = test_template_asn1-template.c
 gen_files_test = asn1_test_asn1.x
 gen_files_digest = asn1_digest_asn1.x
 gen_files_kx509 = asn1_kx509_asn1.x
@@ -53,7 +54,7 @@
 check_der_SOURCES = check-der.c check-common.c check-common.h
 
 check_template_SOURCES = check-template.c check-common.c check-common.h
-nodist_check_template_SOURCES = $(gen_files_test:.x=.c)
+nodist_check_template_SOURCES = $(gen_files_test_template:.x=.c)
 
 dist_check_gen_SOURCES = check-gen.c check-common.c check-common.h
 nodist_check_gen_SOURCES = $(gen_files_test:.x=.c)
@@ -134,6 +135,7 @@
 	$(gen_files_pkcs12) \
 	$(gen_files_digest) \
 	$(gen_files_kx509) \
+	$(gen_files_test_template) \
 	$(gen_files_test) $(nodist_check_gen_SOURCES) \
 	asn1_err.c asn1_err.h \
 	rfc2459_asn1_files rfc2459_asn1*.h* \
@@ -145,6 +147,7 @@
 	pkcs12_asn1_files pkcs12_asn1*.h* \
 	digest_asn1_files digest_asn1*.h* \
 	kx509_asn1_files kx509_asn1*.h* \
+	test_template_asn1_files test_template_asn1*.h* \
 	test_asn1_files test_asn1*.h*
 
 dist_include_HEADERS = der.h heim_asn1.h der-protos.h der-private.h
@@ -170,6 +173,7 @@
 priv_headers += pkcs12_asn1-priv.h
 priv_headers += digest_asn1-priv.h
 priv_headers += kx509_asn1-priv.h
+priv_headers += test_template_asn1.h test_template_asn1-priv.h
 priv_headers += test_asn1.h test_asn1-priv.h
 
 
@@ -178,7 +182,7 @@
 $(libasn1_la_OBJECTS): $(nodist_include_HEADERS) $(priv_headers) asn1_err.h $(srcdir)/der-protos.h $(srcdir)/der-private.h
 $(libasn1base_la_OBJECTS): asn1_err.h $(srcdir)/der-protos.h $(srcdir)/der-private.h
 $(check_gen_OBJECTS): test_asn1.h
-$(check_template_OBJECTS): test_asn1_files
+$(check_template_OBJECTS): test_template_asn1.h test_template_asn1_files
 $(asn1_print_OBJECTS): krb5_asn1.h
 
 asn1parse.h: asn1parse.c
@@ -192,6 +196,7 @@
 $(gen_files_kx509) kx509_asn1.hx kx509_asn1-priv.hx: kx509_asn1_files
 $(gen_files_rfc2459) rfc2459_asn1.hx rfc2459_asn1-priv.hx: rfc2459_asn1_files
 $(gen_files_cms) cms_asn1.hx cms_asn1-priv.hx: cms_asn1_files
+$(gen_files_test_template) test_template_asn1.hx test_template_asn1-priv.hx: test_template_asn1_files
 $(gen_files_test) test_asn1.hx test_asn1-priv.hx: test_asn1_files
 
 rfc2459_asn1_files: asn1_compile$(EXEEXT) $(srcdir)/rfc2459.asn1
@@ -221,6 +226,9 @@
 kx509_asn1_files: asn1_compile$(EXEEXT) $(srcdir)/kx509.asn1
 	$(ASN1_COMPILE) --one-code-file $(srcdir)/kx509.asn1 kx509_asn1 || (rm -f kx509_asn1_files ; exit 1)
 
+test_template_asn1_files: asn1_compile$(EXEEXT) $(srcdir)/test.asn1
+	$(ASN1_COMPILE) --template --sequence=TESTSeqOf $(srcdir)/test.asn1 test_template_asn1 || (rm -f test_template_asn1_files ; exit 1)
+
 test_asn1_files: asn1_compile$(EXEEXT) $(srcdir)/test.asn1
 	$(ASN1_COMPILE) --one-code-file --sequence=TESTSeqOf $(srcdir)/test.asn1 test_asn1 || (rm -f test_asn1_files ; exit 1)
 
diff --git a/crypto/heimdal/lib/asn1/asn1-template.h b/crypto/heimdal/lib/asn1/asn1-template.h
index 107706ce834081e4b75601dbb4f9f9ba5e424015..5fd6b812630f45e012122a3421ceb80becff2c38
GIT binary patch
literal 4104
zc$~FY+mhNw5PddZ(N(TWU`xh`^?egp2{FKwg+w$XuQxA>3<ImOkSIy4y}A5$p3^-N
zi<XO%m+XTjb)P=neWqs^Kfh?f1=!i<K95(oCA8-qFyFp?4bPz8>%D>x+jN!0s|cj}
zlE%fC2qu58iZ59br4-oqv->Cko)%?XZc7E(5|Q)UG)uD8y#b=k=3j2JWR0(1)k3A6
zE`?c10y<v-xhhnCrxs)<*DTA+I7^Fzny{F+U~M*u!esOA_ZWP&h>J3hKW~W$qI3b<
zLP4BDk!|z2(w5J08s+z}%<^?%z}L9Eg)G<4Y+Dk`I$Olccpedl0a31Cqw;lJmTCc;
zJiCh*_)^|RCH|w3CrPreak_$emM&u50kKfrT9xnW(#-Bbbp;7lmo?882;LSYc2q`K
zE)hqcvpaItS`Z2TrCAxzm4S%3fCTx7W}jJi__!=gI!~f_t@52r{o`6NXG51=E!gd1
zi}n3K<v`VF&9uno+qFu|Xt#9FaaA((=dg}SmB&$1?B&<XM#RlFcKuy;!Bw#iB}f{r
z^>otveq7UR@6~G&<3M5M6<d}UbzSS|9zH9YBkUvtl`hbyXk@UMb%sopN*KMsDsdWN
ziH=H<B3qVUaT02-ddQ&Is5y-ohQ>5|ISp4@jagANI*}7DKzJj0ZTSrFedc=~`H&4^
zaDz@Xxk7RoNCuWW1lx0^&j*3@d;!1xW(f@W@kes$t>@kV`!w^J5a9X1r!$8m6H@z@
zD>)Me(%DWh<nGu2WC7Qc;P5Gz2$P;c8HwmP61)*inQu?<(;9Gx%Nt$Lh)b8!jWC}D
zGs~CU4jjveS>Vq+q1mXjAs4n|@hKa20gJ%Iz&<ipf|yv2bI>VrJ!*8out;m*Xf~Y*
z8y#|=*^)ZizuBl9*5}}fG-EcW7xsx^GnRj2)U<;A5+Dej#5T01))?Ds|BEoVEOy|t
zDV2;;h+wcQcI<gWK~zXDnE#R6Ok9EE39VTmn1M;8rPCt|3Wjcc9|VGH>9{MI?*}u<
zJ-0(d6Ym<e!D20p9%`9ASNDuEdHxOYk{)^$47i>!wELv0R?Q+U1gd9CVrw8VE9xm5
z&4SCu4j(hu)~b6%bj=0p;G%Is0A6Ljwr+Hffo`9c3u~)h8v|_UMFl<rYxt2<@iiDn
zLGXHPyb&>pz@F6V(_VPqYCXpzwMb1U)q0cQflz4c(|DOK)Dpr_>V=dnoP=TPDca&x
z9h!-xj8^aTcI<V#{T_YlBhjS&3FZAp@6~=EotJ<IRiV#;{tNtm4a+22Ro`#A-Afa)
z%|mUQ2v3CvV$*z}GApWWN+-yF;M$dLnV~ler<VBe<Vm~tZP}~-ItKuGGh-THeg_b;
zPdG#_!TRT5)>zYAp7G<}6;+}aXArn^ypcw{Jd2Pu;?)_%V9KTg=4;IBGZ=f~;U?0M
zHxG~|X5?7oy>Pwd2^tOY^q#UDjWW-n^kHXnsZsq?`B1u0w(<ND!XUK`G<2S{+YiEa
z;7@3`D?|r=`U%IYG7-8mnA$+tPUnzY$F;w8u$?wO;Qf0|@B`p#9f67R0BcrQ^B8N5
zYv{KcvZTM`?i}W}OAXw{X}Kx$u<W4W*?W9_#5!Ttkoi0OX?PQ_rwYZR&9awFTeTqC
z-Z>FLL#>w>cgAvg8bH0Zk3+Ci^c>VN3h{@6jp(p_f}G}o6Muxf>rhW7ZlOn^lTk=N
zsd%&>N1~584xb4wP6Q4{p+B<Cmu9aDY_;$zgBJ;X&V{>k4*qD-$wW$C_CvgLmRH(P
z#J{VMu3O7O)h4{X;05e1ix+T#QeU<Hx@xsZLOLNa9@-ZbHJZYOqFZODT?K8^B3`9<
zcbVTtIb0Yuy-~C6zTu*Cb(T@372{d1W_>3aYg3anQR%9@-IZCzHX^j4iO*G{q5`Wp
zf*zJjSJ}tB#-9K2QV@K(P3QGm9JUPA<Lba!DGb%)&{_2b)#K1frRl5op`-2&>gS_L
zphvajb?v(e3h{DV57BOANDE9|#aB(=MM)K{((QU5OKFQb+%hE|hx&wupP^?w7$=NR
zL)trI=I^cN46k17O@S-;*k!|GOB01R5awG>NY@s;f<4$hTQd1wEA81v0oKbS^k6zW
zvIQ>38<secafY9g?wUs)ywLDd_CSu_92x6|_^)gjN|dw-w+}2@+yOuCbKrRnv)o4G
byrH9H4wLNDQIs1vj$Y^1Q~bY7ylnjgQU9ZE

literal 4065
zc$~FY+j81S5PddZ(N(G1fJ-3==k9E(gcx8dLSi+e*xnbd0s~fANR%X;crU-b&)Yo`
z26M^o%laXbx=)|(KGQQyUY<AL9PDiMkjIPL5}MN%nD5`eg%{B6bl$+{b-GC6MFdja
zrEzf=!RYTrahD}gN`Xy3dx#R?X;H@Ix>S(O5jnk0vm{$Q7$C}QdUu;8OMLyNW-4v9
zDa=X|(D@3;RiW~GH6uH@CRtv_Sz7GXgvGoEYqd%gCY!c@#Nex0T$FkIbxlMNr88I;
z3gQ%sY@JV)wtS7#D1U%?mM;qfzQyG&WVwE3>ylWO*({#N(}*|>h;juhl`rG6R5MuR
z*?m02m-03$@gIdeNs@hw(*;bkbQbFlh=t;os{BxwX14dLD@d@qtZ6nw@VY3mqcXyB
zi8%V2-IJ@<f=KW$&B}PH3`E2QB*;fJ+swMdr)6Q%X%fXtm2YI~9@c_6cXZj*g5A#6
zSl|Cs4pfcSOtWmdUaGW=HcR&sS0zJ#4$G)ic^oChR(`!~M7-O^roW3exGL761WBW%
zo=$q-j%%82y?QNT94M^3V$1TPu4@@Rz*j|cgq>ud(i!>`jSLpE%#f*438QCNB~ByE
z(NQT<Wb^VHPD0I94;d6IHKh^5(3oZ~r{PMgF)NClPUMIS5Z*vuSv~`NpZMMv-e-O2
z-Jlaqu8>>?l7Z#+!S-C~^Ijl5U%+p_Spq|zKPQ*odhQLd>xs{V0M7?Lo;VztklMFg
z$(b;a&US)6cZUWb3%H&HhmW~LnDh+FNJNK`;0<8Re0zkSR*ySe-spk`T)LEQfcY$#
zSia<T;8;FP0)OHO%|@N|xv(9Jk6FJBSOg{p_Jz3;#K>}-y-tzqNuxc6MOr;av*}FO
zXrKGcmekSq%|_+0J_k>v39~u9uxp0RSpJPs(+c)WfFN`dTi+U6Lu{}4FT&um*n!W+
zR5D5-g5IXsq387lQ6arx{ugdDaS4tmv}S=|1}2e~PLC`o7`pMj7YMGU<E~`BA50|o
z+!hgyyerfOi?uMiuVwaJ-80JM`8UK%dgxU!;A+Is?vtuoHH)+msGco}Z3l^2QBS$k
zEVyjw@F8<;t-41<S6r|bE*cjE;8o@;>qhq&==N#3u(s-TXMhd8sK5tc^}lc`z6Rqc
z2wsnkHy|bv*rQr~+6ylmjhA?&7O4rPTCNg25DIO57SGd}nnM^$y^xZHqcChdLtC7x
zeKV1i(c**Nj-7V9+o4Z=B$~88p?p~Bz1r=f^8)aoD)c$feTCm|VV*>b>ib>0ePKej
zdaP{~;i>RQY?_Z$W<|A5=>+)?T$|D@GxR3m*b<-5&YGR?^G@~G+5^a&3DW@c2Y`@W
z;}E$7>z;yHLrrsW!jF4bREb`lK;X{t1{(4DBtq7RHzyFiF&p=ouQ6{=VC<2Hn@B_6
zJwkRd1IHR}h3m|Z&}fLK_mt&mlz9rJ4?CMnjp`oDhth?ziRYIP2B~eJp>@`5J__4{
zKcU&I5H0xl5yz`C5xO#%+CbP=YoA-kHNUs8ohClu(<e>v6X0qcfQfPsYgSnE5Ni!<
z==T~jr@zDQ9OgDl4P3`*xhnIpY@y-BCwzUvI$~Cz`5XLk_%2>g6^cijWh<GsYC*KU
zbtHm@S}!r~jQRXHfO=~lhG3`Y*{fp^;tvHI&|!OqoaUYre}ufNP){aqp(mlEK}bKT
zc(flzqK`Qap9n6F1oj4@Kd{Z$W~T~lH1H~e7YTjNg`0B@{%Fw2L`q(CL%egAm)cOo
zzpIe0Tk}HICcM4i1?)bHXK;>EUpD@_Y&1whIw3J0n&%ZYn!=f)TW70T1+CK}UZi+;
znchY@oEtU0QL}Bn;k<Qul2N4<<4LaF`i?Tzrd`rRrHk@*Q)U&r6QK>e_*^9_DzJ(J
z=zh6$m3_)<Z26xq1;OX*bXu>)e#=ljF87?3!caZ-omF2@J@%bcn!al9JL>MBem<E5
zdQ?kZ*S?vc5HGj&5N%e5w7}F=eAV=QlvL3wT`#w>l(wkDEmPugs84A489K(Jam4sI
zq`fm_{?>Y62wcI3F6(bCc(q`@<%Dz}!MoL?-LoZ=KeW<j+(~7<K0x=zlLK4ea=bc;
zBN-?7Dd`e<;K7>;KV}c);N5|-ZixTN`k_RvcH#D(MXT21hkf=u&taCk(>UMJOfrW_
Vc6|`#29Bc_u<;E4lM>Gx{{Sopnt1>K

diff --git a/crypto/heimdal/lib/asn1/asn1parse.h b/crypto/heimdal/lib/asn1/asn1parse.h
--- a/crypto/heimdal/lib/asn1/asn1parse.h
+++ b/crypto/heimdal/lib/asn1/asn1parse.h
@@ -224,7 +224,7 @@
 typedef union YYSTYPE
 #line 71 "asn1parse.y"
 {
-    int constant;
+    int64_t constant;
     struct value *value;
     struct range *range;
     char *name;
diff --git a/crypto/heimdal/lib/asn1/asn1parse.c b/crypto/heimdal/lib/asn1/asn1parse.c
--- a/crypto/heimdal/lib/asn1/asn1parse.c
+++ b/crypto/heimdal/lib/asn1/asn1parse.c
@@ -304,7 +304,7 @@
 typedef union YYSTYPE
 #line 71 "asn1parse.y"
 {
-    int constant;
+    int64_t constant;
     struct value *value;
     struct range *range;
     char *name;
@@ -1874,7 +1874,7 @@
 			lex_error_message("Non-integer in first part of range");
 		    (yyval.range) = ecalloc(1, sizeof(*(yyval.range)));
 		    (yyval.range)->min = (yyvsp[(2) - (5)].value)->u.integervalue;
-		    (yyval.range)->max = (yyvsp[(2) - (5)].value)->u.integervalue - 1;
+		    (yyval.range)->max = INT_MAX;
 		}
     break;
 
@@ -1884,7 +1884,7 @@
 		    if((yyvsp[(4) - (5)].value)->type != integervalue)
 			lex_error_message("Non-integer in second part of range");
 		    (yyval.range) = ecalloc(1, sizeof(*(yyval.range)));
-		    (yyval.range)->min = (yyvsp[(4) - (5)].value)->u.integervalue + 2;
+		    (yyval.range)->min = INT_MIN;
 		    (yyval.range)->max = (yyvsp[(4) - (5)].value)->u.integervalue;
 		}
     break;
diff --git a/crypto/heimdal/lib/asn1/asn1parse.y b/crypto/heimdal/lib/asn1/asn1parse.y
--- a/crypto/heimdal/lib/asn1/asn1parse.y
+++ b/crypto/heimdal/lib/asn1/asn1parse.y
@@ -69,7 +69,7 @@
 %}
 
 %union {
-    int constant;
+    int64_t constant;
     struct value *value;
     struct range *range;
     char *name;
@@ -370,14 +370,14 @@
 			lex_error_message("Non-integer in first part of range");
 		    $$ = ecalloc(1, sizeof(*$$));
 		    $$->min = $2->u.integervalue;
-		    $$->max = $2->u.integervalue - 1;
+		    $$->max = INT_MAX;
 		}
 		| '(' kw_MIN RANGE Value ')'
 		{
 		    if($4->type != integervalue)
 			lex_error_message("Non-integer in second part of range");
 		    $$ = ecalloc(1, sizeof(*$$));
-		    $$->min = $4->u.integervalue + 2;
+		    $$->min = INT_MIN;
 		    $$->max = $4->u.integervalue;
 		}
 		| '(' Value ')'
diff --git a/crypto/heimdal/lib/asn1/check-gen.c b/crypto/heimdal/lib/asn1/check-gen.c
--- a/crypto/heimdal/lib/asn1/check-gen.c
+++ b/crypto/heimdal/lib/asn1/check-gen.c
@@ -764,6 +764,124 @@
     return failed;
 }
 
+static int
+check_tag_length64(void)
+{
+    struct test_data td[] = {
+	{ 1, 3, 3, "\x02\x01\x00"},
+	{ 1, 7, 7, "\x02\x05\x01\xff\xff\xff\xff"},
+	{ 1, 7, 7, "\x02\x05\x02\x00\x00\x00\x00"},
+	{ 1, 9, 9, "\x02\x07\x7f\xff\xff\xff\xff\xff\xff"},
+	{ 1, 10, 10, "\x02\x08\x00\x80\x00\x00\x00\x00\x00\x00"},
+	{ 1, 10, 10, "\x02\x08\x7f\xff\xff\xff\xff\xff\xff\xff"},
+	{ 1, 11, 11, "\x02\x09\x00\xff\xff\xff\xff\xff\xff\xff\xff"},
+	{ 0, 3, 0, "\x02\x02\x00"},
+	{ 0, 3, 0, "\x02\x7f\x7f"},
+	{ 0, 4, 0, "\x02\x03\x00\x80"},
+	{ 0, 4, 0, "\x02\x7f\x01\x00"},
+	{ 0, 5, 0, "\x02\xff\x7f\x02\x00"}
+    };
+    size_t sz;
+    TESTuint64 values[] = {0, 8589934591LL, 8589934592LL,
+			   36028797018963967LL, 36028797018963968LL,
+			   9223372036854775807LL, 18446744073709551615ULL,
+			   0, 127, 128, 256, 512 };
+    TESTuint64 u;
+    int i, ret, failed = 0;
+    void *buf;
+
+    for (i = 0; i < sizeof(td)/sizeof(td[0]); i++) {
+	struct map_page *page;
+
+	buf = map_alloc(OVERRUN, td[i].data, td[i].len, &page);
+
+	ret = decode_TESTuint64(buf, td[i].len, &u, &sz);
+	if (ret) {
+	    if (td[i].ok) {
+		printf("failed with tag len test %d\n", i);
+		printf("ret = %d\n", ret);
+		failed = 1;
+	    }
+	} else {
+	    if (td[i].ok == 0) {
+		printf("failed with success for tag len test %d\n", i);
+		failed = 1;
+	    }
+	    if (td[i].expected_len != sz) {
+		printf("wrong expected size for tag test %d\n", i);
+		printf("sz = %d\n", sz);
+		failed = 1;
+	    }
+	    if (values[i] != u) {
+		printf("wrong value for tag test %d\n", i);
+		printf("Expected value: %lld\nActual value: %lld\n", values[i], u);
+		failed = 1;
+	    }
+	}
+	map_free(page, "test", "decode");
+    }
+    return failed;
+}
+
+static int
+check_tag_length64s(void)
+{
+    struct test_data td[] = {
+	{ 1, 3, 3, "\x02\x01\x00"},
+	{ 1, 7, 7, "\x02\x05\xfe\x00\x00\x00\x01"},
+	{ 1, 7, 7, "\x02\x05\xfe\x00\x00\x00\x00"},
+	{ 1, 9, 9, "\x02\x07\x80\x00\x00\x00\x00\x00\x01"},
+	{ 1, 9, 9, "\x02\x07\x80\x00\x00\x00\x00\x00\x00"},
+	{ 1, 10, 10, "\x02\x08\x80\x00\x00\x00\x00\x00\x00\x01"},
+	{ 1, 9, 9, "\x02\x07\x80\x00\x00\x00\x00\x00\x01"},
+	{ 0, 3, 0, "\x02\x02\x00"},
+	{ 0, 3, 0, "\x02\x7f\x7f"},
+	{ 0, 4, 0, "\x02\x03\x00\x80"},
+	{ 0, 4, 0, "\x02\x7f\x01\x00"},
+	{ 0, 5, 0, "\x02\xff\x7f\x02\x00"}
+    };
+    size_t sz;
+    TESTint64 values[] = {0, -8589934591LL, -8589934592LL,
+			   -36028797018963967LL, -36028797018963968LL,
+			   -9223372036854775807LL, -36028797018963967LL,
+			   0, 127, 128, 256, 512 };
+    TESTint64 u;
+    int i, ret, failed = 0;
+    void *buf;
+
+    for (i = 0; i < sizeof(td)/sizeof(td[0]); i++) {
+	struct map_page *page;
+
+	buf = map_alloc(OVERRUN, td[i].data, td[i].len, &page);
+
+	ret = decode_TESTint64(buf, td[i].len, &u, &sz);
+	if (ret) {
+	    if (td[i].ok) {
+		printf("failed with tag len test %d\n", i);
+		printf("ret = %d\n", ret);
+		failed = 1;
+	    }
+	} else {
+	    if (td[i].ok == 0) {
+		printf("failed with success for tag len test %d\n", i);
+		failed = 1;
+	    }
+	    if (td[i].expected_len != sz) {
+		printf("wrong expected size for tag test %d\n", i);
+		printf("sz = %d\n", sz);
+		failed = 1;
+	    }
+	    if (values[i] != u) {
+		printf("wrong value for tag test %d\n", i);
+		printf("Expected value: %lld\nActual value: %lld\n", values[i], u);
+		failed = 1;
+	    }
+	}
+	map_free(page, "test", "decode");
+    }
+    return failed;
+}
+
 static int
 cmp_TESTChoice (void *a, void *b)
 {
@@ -1291,6 +1409,8 @@
     ret += test_cert();
 
     ret += check_tag_length();
+    ret += check_tag_length64();
+    ret += check_tag_length64s();
     ret += test_large_tag();
     ret += test_choice();
 
diff --git a/crypto/heimdal/lib/asn1/der-protos.h b/crypto/heimdal/lib/asn1/der-protos.h
--- a/crypto/heimdal/lib/asn1/der-protos.h
+++ b/crypto/heimdal/lib/asn1/der-protos.h
@@ -67,6 +67,11 @@
 	const int */*from*/,
 	int */*to*/);
 
+int
+der_copy_integer64 (
+	const int64_t */*from*/,
+	int64_t */*to*/);
+
 int
 der_copy_octet_string (
 	const heim_octet_string */*from*/,
@@ -92,6 +97,11 @@
 	const unsigned */*from*/,
 	unsigned */*to*/);
 
+int
+der_copy_unsigned64 (
+	const uint64_t */*from*/,
+	uint64_t */*to*/);
+
 int
 der_copy_utctime (
 	const time_t */*from*/,
@@ -128,6 +138,9 @@
 void
 der_free_integer (int */*i*/);
 
+void
+der_free_integer64 (int64_t */*i*/);
+
 void
 der_free_octet_string (heim_octet_string */*k*/);
 
@@ -143,6 +156,9 @@
 void
 der_free_unsigned (unsigned */*u*/);
 
+void
+der_free_unsigned64 (uint64_t */*u*/);
+
 void
 der_free_utctime (time_t */*t*/);
 
@@ -214,6 +230,13 @@
 	int */*ret*/,
 	size_t */*size*/);
 
+int
+der_get_integer64 (
+	const unsigned char */*p*/,
+	size_t /*len*/,
+	int64_t */*ret*/,
+	size_t */*size*/);
+
 int
 der_get_length (
 	const unsigned char */*p*/,
@@ -284,6 +307,13 @@
 	unsigned */*ret*/,
 	size_t */*size*/);
 
+int
+der_get_unsigned64 (
+	const unsigned char */*p*/,
+	size_t /*len*/,
+	uint64_t */*ret*/,
+	size_t */*size*/);
+
 int
 der_get_utctime (
 	const unsigned char */*p*/,
@@ -367,6 +397,9 @@
 size_t
 der_length_integer (const int */*data*/);
 
+size_t
+der_length_integer64 (const int64_t */*data*/);
+
 size_t
 der_length_len (size_t /*len*/);
 
@@ -388,6 +421,9 @@
 size_t
 der_length_unsigned (const unsigned */*data*/);
 
+size_t
+der_length_unsigned64 (const uint64_t */*data*/);
+
 size_t
 der_length_utctime (const time_t */*t*/);
 
@@ -508,6 +544,13 @@
 	const int */*v*/,
 	size_t */*size*/);
 
+int
+der_put_integer64 (
+	unsigned char */*p*/,
+	size_t /*len*/,
+	const int64_t */*v*/,
+	size_t */*size*/);
+
 int
 der_put_length (
 	unsigned char */*p*/,
@@ -569,6 +612,13 @@
 	const unsigned */*v*/,
 	size_t */*size*/);
 
+int
+der_put_unsigned64 (
+	unsigned char */*p*/,
+	size_t /*len*/,
+	const uint64_t */*v*/,
+	size_t */*size*/);
+
 int
 der_put_utctime (
 	unsigned char */*p*/,
diff --git a/crypto/heimdal/lib/asn1/der_copy.c b/crypto/heimdal/lib/asn1/der_copy.c
--- a/crypto/heimdal/lib/asn1/der_copy.c
+++ b/crypto/heimdal/lib/asn1/der_copy.c
@@ -54,6 +54,13 @@
     return 0;
 }
 
+int
+der_copy_integer64 (const int64_t *from, int64_t *to)
+{
+    *to = *from;
+    return 0;
+}
+
 int
 der_copy_unsigned (const unsigned *from, unsigned *to)
 {
@@ -61,6 +68,13 @@
     return 0;
 }
 
+int
+der_copy_unsigned64 (const uint64_t *from, uint64_t *to)
+{
+    *to = *from;
+    return 0;
+}
+
 int
 der_copy_generalized_time (const time_t *from, time_t *to)
 {
diff --git a/crypto/heimdal/lib/asn1/der_free.c b/crypto/heimdal/lib/asn1/der_free.c
--- a/crypto/heimdal/lib/asn1/der_free.c
+++ b/crypto/heimdal/lib/asn1/der_free.c
@@ -50,12 +50,24 @@
     *i = 0;
 }
 
+void
+der_free_integer64 (int64_t *i)
+{
+    *i = 0;
+}
+
 void
 der_free_unsigned (unsigned *u)
 {
     *u = 0;
 }
 
+void
+der_free_unsigned64 (uint64_t *u)
+{
+    *u = 0;
+}
+
 void
 der_free_generalized_time(time_t *t)
 {
diff --git a/crypto/heimdal/lib/asn1/der_get.c b/crypto/heimdal/lib/asn1/der_get.c
--- a/crypto/heimdal/lib/asn1/der_get.c
+++ b/crypto/heimdal/lib/asn1/der_get.c
@@ -48,9 +48,28 @@
     unsigned val = 0;
     size_t oldlen = len;
 
-    if (len == sizeof(unsigned) + 1 && p[0] == 0)
+    if (len == sizeof(val) + 1 && p[0] == 0)
 	;
-    else if (len > sizeof(unsigned))
+    else if (len > sizeof(val))
+	return ASN1_OVERRUN;
+
+    while (len--)
+	val = val * 256 + *p++;
+    *ret = val;
+    if(size) *size = oldlen;
+    return 0;
+}
+
+int
+der_get_unsigned64 (const unsigned char *p, size_t len,
+		    uint64_t *ret, size_t *size)
+{
+    uint64_t val = 0;
+    size_t oldlen = len;
+
+    if (len == sizeof(val) + 1 && p[0] == 0)
+	;
+    else if (len > sizeof(val))
 	return ASN1_OVERRUN;
 
     while (len--)
@@ -67,7 +86,27 @@
     int val = 0;
     size_t oldlen = len;
 
-    if (len > sizeof(int))
+    if (len > sizeof(val))
+	return ASN1_OVERRUN;
+
+    if (len > 0) {
+	val = (signed char)*p++;
+	while (--len)
+	    val = val * 256 + *p++;
+    }
+    *ret = val;
+    if(size) *size = oldlen;
+    return 0;
+}
+
+int
+der_get_integer64 (const unsigned char *p, size_t len,
+		   int64_t *ret, size_t *size)
+{
+    int64_t val = 0;
+    size_t oldlen = len;
+
+    if (len > sizeof(val))
 	return ASN1_OVERRUN;
 
     if (len > 0) {
diff --git a/crypto/heimdal/lib/asn1/der_length.c b/crypto/heimdal/lib/asn1/der_length.c
--- a/crypto/heimdal/lib/asn1/der_length.c
+++ b/crypto/heimdal/lib/asn1/der_length.c
@@ -55,6 +55,24 @@
     return ret;
 }
 
+size_t
+_heim_len_unsigned64 (uint64_t val)
+{
+    size_t ret = 0;
+    int last_val_gt_128;
+
+    do {
+	++ret;
+	last_val_gt_128 = (val >= 128);
+	val /= 256;
+    } while (val);
+
+    if(last_val_gt_128)
+	ret++;
+
+    return ret;
+}
+
 size_t
 _heim_len_int (int val)
 {
@@ -82,6 +100,33 @@
     return ret;
 }
 
+size_t
+_heim_len_int64 (int64_t val)
+{
+    unsigned char q;
+    size_t ret = 0;
+
+    if (val >= 0) {
+	do {
+	    q = val % 256;
+	    ret++;
+	    val /= 256;
+	} while(val);
+	if(q >= 128)
+	    ret++;
+    } else {
+	val = ~val;
+	do {
+	    q = ~(val % 256);
+	    ret++;
+	    val /= 256;
+	} while(val);
+	if(q < 128)
+	    ret++;
+    }
+    return ret;
+}
+
 static size_t
 len_oid (const heim_oid *oid)
 {
@@ -134,12 +179,24 @@
     return _heim_len_int (*data);
 }
 
+size_t
+der_length_integer64 (const int64_t *data)
+{
+    return _heim_len_int64 (*data);
+}
+
 size_t
 der_length_unsigned (const unsigned *data)
 {
     return _heim_len_unsigned(*data);
 }
 
+size_t
+der_length_unsigned64 (const uint64_t *data)
+{
+    return _heim_len_unsigned64(*data);
+}
+
 size_t
 der_length_enumerated (const unsigned *data)
 {
diff --git a/crypto/heimdal/lib/asn1/der_put.c b/crypto/heimdal/lib/asn1/der_put.c
--- a/crypto/heimdal/lib/asn1/der_put.c
+++ b/crypto/heimdal/lib/asn1/der_put.c
@@ -75,6 +75,38 @@
     }
 }
 
+int
+der_put_unsigned64 (unsigned char *p, size_t len, const uint64_t *v, size_t *size)
+{
+    unsigned char *base = p;
+    uint64_t val = *v;
+
+    if (val) {
+	while (len > 0 && val) {
+	    *p-- = val % 256;
+	    val /= 256;
+	    --len;
+	}
+	if (val != 0)
+	    return ASN1_OVERFLOW;
+	else {
+	    if(p[1] >= 128) {
+		if(len < 1)
+		    return ASN1_OVERFLOW;
+		*p-- = 0;
+	    }
+	    *size = base - p;
+	    return 0;
+	}
+    } else if (len < 1)
+	return ASN1_OVERFLOW;
+    else {
+	*p    = 0;
+	*size = 1;
+	return 0;
+    }
+}
+
 int
 der_put_integer (unsigned char *p, size_t len, const int *v, size_t *size)
 {
@@ -115,6 +147,46 @@
     return 0;
 }
 
+int
+der_put_integer64 (unsigned char *p, size_t len, const int64_t *v, size_t *size)
+{
+    unsigned char *base = p;
+    int64_t val = *v;
+
+    if(val >= 0) {
+	do {
+	    if(len < 1)
+		return ASN1_OVERFLOW;
+	    *p-- = val % 256;
+	    len--;
+	    val /= 256;
+	} while(val);
+	if(p[1] >= 128) {
+	    if(len < 1)
+		return ASN1_OVERFLOW;
+	    *p-- = 0;
+	    len--;
+	}
+    } else {
+	val = ~val;
+	do {
+	    if(len < 1)
+		return ASN1_OVERFLOW;
+	    *p-- = ~(val % 256);
+	    len--;
+	    val /= 256;
+	} while(val);
+	if(p[1] < 128) {
+	    if(len < 1)
+		return ASN1_OVERFLOW;
+	    *p-- = 0xff;
+	    len--;
+	}
+    }
+    *size = base - p;
+    return 0;
+}
+
 
 int
 der_put_length (unsigned char *p, size_t len, size_t val, size_t *size)
diff --git a/crypto/heimdal/lib/asn1/gen.c b/crypto/heimdal/lib/asn1/gen.c
--- a/crypto/heimdal/lib/asn1/gen.c
+++ b/crypto/heimdal/lib/asn1/gen.c
@@ -303,7 +303,7 @@
 	fprintf(codefile, "if((%s = strdup(\"%s\")) == NULL)\nreturn ENOMEM;\n", var, val->u.stringvalue);
 	break;
     case integervalue:
-	fprintf(codefile, "%s = %d;\n", var, val->u.integervalue);
+	fprintf(codefile, "%s = %" PRId64 ";\n", var, val->u.integervalue);
 	break;
     case booleanvalue:
 	if(val->u.booleanvalue)
@@ -324,7 +324,7 @@
 	fprintf(codefile, "if(strcmp(%s, \"%s\") != 0)\n", var, val->u.stringvalue);
 	break;
     case integervalue:
-	fprintf(codefile, "if(%s != %d)\n", var, val->u.integervalue);
+	fprintf(codefile, "if(%s != %" PRId64 ")\n", var, val->u.integervalue);
 	break;
     case booleanvalue:
 	if(val->u.booleanvalue)
@@ -397,7 +397,7 @@
     case booleanvalue:
 	break;
     case integervalue:
-	fprintf (headerfile, "enum { %s = %d };\n\n",
+	fprintf (headerfile, "enum { %s = %" PRId64 " };\n\n",
 		 s->gen_name, s->value->u.integervalue);
 	break;
     case nullvalue:
@@ -540,7 +540,7 @@
 	if(t->members == NULL) {
             fprintf (headerfile, "INTEGER");
 	    if (t->range)
-		fprintf (headerfile, " (%d..%d)",
+		fprintf (headerfile, " (%" PRId64 "..%" PRId64 ")",
 			 t->range->min, t->range->max);
         } else {
 	    Member *m;
@@ -723,14 +723,16 @@
             fprintf (headerfile, "} %s;\n", name);
 	} else if (t->range == NULL) {
 	    fprintf (headerfile, "heim_integer %s;\n", name);
-	} else if (t->range->min == INT_MIN && t->range->max == INT_MAX) {
+	} else if (t->range->min < INT_MIN && t->range->max <= INT64_MAX) {
+	    fprintf (headerfile, "int64_t %s;\n", name);
+	} else if (t->range->min >= 0 && t->range->max > UINT_MAX) {
+	    fprintf (headerfile, "uint64_t %s;\n", name);
+	} else if (t->range->min >= INT_MIN && t->range->max <= INT_MAX) {
 	    fprintf (headerfile, "int %s;\n", name);
-	} else if (t->range->min == 0 && t->range->max == UINT_MAX) {
-	    fprintf (headerfile, "unsigned int %s;\n", name);
-	} else if (t->range->min == 0 && t->range->max == INT_MAX) {
+	} else if (t->range->min >= 0 && t->range->max <= UINT_MAX) {
 	    fprintf (headerfile, "unsigned int %s;\n", name);
 	} else
-	    errx(1, "%s: unsupported range %d -> %d",
+	    errx(1, "%s: unsupported range %" PRId64 " -> %" PRId64 "",
 		 name, t->range->min, t->range->max);
 	break;
     case TBoolean:
diff --git a/crypto/heimdal/lib/asn1/gen_decode.c b/crypto/heimdal/lib/asn1/gen_decode.c
--- a/crypto/heimdal/lib/asn1/gen_decode.c
+++ b/crypto/heimdal/lib/asn1/gen_decode.c
@@ -189,19 +189,19 @@
 {
     if (r->min == r->max + 2 || r->min < r->max)
 	fprintf (codefile,
-		 "if ((%s)->%s > %d) {\n"
+		 "if ((%s)->%s > %" PRId64 ") {\n"
 		 "e = ASN1_MAX_CONSTRAINT; %s;\n"
 		 "}\n",
 		 name, length, r->max, forwstr);
     if (r->min - 1 == r->max || r->min < r->max)
 	fprintf (codefile,
-		 "if ((%s)->%s < %d) {\n"
+		 "if ((%s)->%s < %" PRId64 ") {\n"
 		 "e = ASN1_MIN_CONSTRAINT; %s;\n"
 		 "}\n",
 		 name, length, r->min, forwstr);
     if (r->max == r->min)
 	fprintf (codefile,
-		 "if ((%s)->%s != %d) {\n"
+		 "if ((%s)->%s != %" PRId64 ") {\n"
 		 "e = ASN1_EXACT_CONSTRAINT; %s;\n"
 		 "}\n",
 		 name, length, r->min, forwstr);
@@ -252,14 +252,16 @@
 		    name);
 	} else if (t->range == NULL) {
 	    decode_primitive ("heim_integer", name, forwstr);
-	} else if (t->range->min == INT_MIN && t->range->max == INT_MAX) {
+	} else if (t->range->min < INT_MIN && t->range->max <= INT64_MAX) {
+	    decode_primitive ("integer64", name, forwstr);
+	} else if (t->range->min >= 0 && t->range->max > UINT_MAX) {
+	    decode_primitive ("unsigned64", name, forwstr);
+	} else if (t->range->min >= INT_MIN && t->range->max <= INT_MAX) {
 	    decode_primitive ("integer", name, forwstr);
-	} else if (t->range->min == 0 && t->range->max == UINT_MAX) {
-	    decode_primitive ("unsigned", name, forwstr);
-	} else if (t->range->min == 0 && t->range->max == INT_MAX) {
+	} else if (t->range->min >= 0 && t->range->max <= UINT_MAX) {
 	    decode_primitive ("unsigned", name, forwstr);
 	} else
-	    errx(1, "%s: unsupported range %d -> %d",
+	    errx(1, "%s: unsupported range %" PRId64 " -> %" PRId64,
 		 name, t->range->min, t->range->max);
 	break;
     case TBoolean:
diff --git a/crypto/heimdal/lib/asn1/gen_encode.c b/crypto/heimdal/lib/asn1/gen_encode.c
--- a/crypto/heimdal/lib/asn1/gen_encode.c
+++ b/crypto/heimdal/lib/asn1/gen_encode.c
@@ -129,14 +129,16 @@
 	    fprintf(codefile, "}\n;");
 	} else if (t->range == NULL) {
 	    encode_primitive ("heim_integer", name);
-	} else if (t->range->min == INT_MIN && t->range->max == INT_MAX) {
+	} else if (t->range->min < INT_MIN && t->range->max <= INT64_MAX) {
+	    encode_primitive ("integer64", name);
+	} else if (t->range->min >= 0 && t->range->max > UINT_MAX) {
+	    encode_primitive ("unsigned64", name);
+	} else if (t->range->min >= INT_MIN && t->range->max <= INT_MAX) {
 	    encode_primitive ("integer", name);
-	} else if (t->range->min == 0 && t->range->max == UINT_MAX) {
-	    encode_primitive ("unsigned", name);
-	} else if (t->range->min == 0 && t->range->max == INT_MAX) {
+	} else if (t->range->min >= 0 && t->range->max <= UINT_MAX) {
 	    encode_primitive ("unsigned", name);
 	} else
-	    errx(1, "%s: unsupported range %d -> %d",
+	    errx(1, "%s: unsupported range %" PRId64 " -> %" PRId64,
 		 name, t->range->min, t->range->max);
 	constructed = 0;
 	break;
diff --git a/crypto/heimdal/lib/asn1/gen_length.c b/crypto/heimdal/lib/asn1/gen_length.c
--- a/crypto/heimdal/lib/asn1/gen_length.c
+++ b/crypto/heimdal/lib/asn1/gen_length.c
@@ -80,14 +80,16 @@
 	    fprintf(codefile, "}\n");
 	} else if (t->range == NULL) {
 	    length_primitive ("heim_integer", name, variable);
-	} else if (t->range->min == INT_MIN && t->range->max == INT_MAX) {
+	} else if (t->range->min < INT_MIN && t->range->max <= INT64_MAX) {
+	    length_primitive ("integer64", name, variable);
+	} else if (t->range->min >= 0 && t->range->max > UINT_MAX) {
+	    length_primitive ("unsigned64", name, variable);
+	} else if (t->range->min >= INT_MIN && t->range->max <= INT_MAX) {
 	    length_primitive ("integer", name, variable);
-	} else if (t->range->min == 0 && t->range->max == UINT_MAX) {
-	    length_primitive ("unsigned", name, variable);
-	} else if (t->range->min == 0 && t->range->max == INT_MAX) {
+	} else if (t->range->min >= 0 && t->range->max <= UINT_MAX) {
 	    length_primitive ("unsigned", name, variable);
 	} else
-	    errx(1, "%s: unsupported range %d -> %d",
+	    errx(1, "%s: unsupported range %" PRId64 " -> %" PRId64,
 		 name, t->range->min, t->range->max);
 
 	break;
diff --git a/crypto/heimdal/lib/asn1/gen_template.c b/crypto/heimdal/lib/asn1/gen_template.c
index edd68e12238009d796c30f2fa77667a507b4291b..15bf7d30c4983684d5e2553487dda870e8f4c4b5
GIT binary patch
literal 22932
zc%1EATX)+=l71F{MTdLr0Tfu4GD&t~jh#bDkc2Z7sgRH_b2%7@1SK4U07W!?S;v2S
zpSP;-jSET1$~>)4Vw33Zx^?x}Rn-kX-|diHa$GDvFVmY_N}P#H4u1LNzsWQ5!~XtH
z<Zr9|CQEN(5+?8Sw0s|v^Z&gm-xpb&<3MLre2y~`<Rwk%iYBC(LC?u;US!41XOE0&
zF?oMmWOMlVF_|X0yNAPiSw<MYk}Q)lS$;^S_#B%qizQ8qysXFs!u&#di$#_Iv&r5%
z3ZrD2mUNk3uaFRl^C?-C2}yHO7OUkXVNb5pJYIe#vtl_fJ@PT7x1?CIe~T4GD)VBR
z&eBPYG&~Y76S7E_^OVwLN*2rFLpp^I^fspOR|0ghtoWGbH)K-e)0Am|RB+rpp)Z7J
z2YVIiN;H@dYf?<1^Qxqv5sg7yBphECAFxT-0*Sz%yrAhM@t{Xqk__k}8O@n#Xp03*
zCs~}%lchA%4|Q39r(qW<3urrCfqZ|AID{)IC{2sWYM$gYmQ(i}W~G4kC7H)GS*CGT
zYV)&cL&BySQold%kwKEOq1Yvl=gd3tvv$|K(5-APQgA4coKq{7rI2eLe<s%n`VnYS
zkR+c%TY@eF!psYx#H|FQrywPGBbh-1w@6vc=tuAbK}$FpDHq8ET?~e%=zB|auAIAB
zSsI#z=fRkaho|A2-pD8L`EoRT9h~?l<meqV!lS`B48p6>C%wT5IUWweQE+q>4o741
z?|=8kFyv2v!X~!#2JeXf_HyKp$7DDn!Np}i07^i5)Ek6>KlXs!asTQh7@T<osF1-h
zB>mtb2%%dz^pGPGs*fbYQ*z;tj?dw1?<nX8;X5YKX%G&O-6`<vk;~pF434k*y%D**
z8eI;@j2dco5{!@gz2L$>*&`qXFed(Me-M)Kd9UBEXbQ9}MUQ+CvUk*H)EFmF^duPh
z$02H@KOKYRK)ya8(xrbK;0OP$56bjL?>s?v?EiKJouCn^o%AkxXP}<5!7wl_$5$i&
z0!0Q>jIWNQuxG>J$rwoi`LREG9US}PL((6Pna!@oz6VUg9%Bzwz+lh}pO3D_0W)1N
z2>sFM>M{(50~ZOM58r@oK-eCPK4E4a4w%khrs3!v(nWi)S@6i4b040M(5lR8J+#Fb
ztaltDHKQkR1$%~uvSi?&^@B5iaLlYeL_%+ZvG2m91!L?GaL#Xf@0gBPOnsa#kd1#d
z9N1%%N`h0;J9!<T@S-!g!Z;9aGdx8~<E!IyVSQW+&pVy}O7ls!0-WsLBzcq-lWgy{
z+v$`D7!zE$fIXAjcu984&-3ddi*R8(=5tT<3O_Frvg;nou^)<bN`Ppx1e}RzGGAou
z19WQ~&%af^uKm{8fj_YRIcE=mkLtfbkR~lU6a|R5GL{_IahafUwm#JDeCZ&_z!tJv
z0<u1P#m7E-g$Ba`hn=s@tU!w7CRsj!Svn&QaGEFc>ttEFogKlw3naUT<oPan`}Qq>
z=4uXGK!Fp9qmm4FWj=Hn=Qjy?`H~E-`hA1IZIaF-Az1gYc^EK;J>;*rMxqOF#ivh+
z(G-6oe|?E<KmQnA^xoRS!85v^?5me#zfSQLxnkTbdaG>-ZV<FC=0ijTT1_(MWqOk*
zQ<LJC&JJwrOX|4%A^y1<jQkz|IpC=y#<H2=J-)WN&~;H{Nt{32Uxl_nzL9=0p$WyU
zKEL?}9?Yp2sfg3+wyudXxmzXq<QrC??A6MGLKO53%CO<IT>~0_gQ-jq)gus8R@Vqj
zZYx`kq}k)ll_0ipwjhv#(D6D;9*3<Ww~=ug|MWO4fzU=~AJQ^?G#v%8jZ9Z`_Ls-u
zh?F+6yPhu|hZ_*utXmEN`?7p2Z&l<rGKP@jn_(=SuCZeJaIkFK(>0#eZJpYHib5?R
zCnB68+y4<Y@PGD!(=df{%(%^6AGk3ob4t=O;(UN9BU}FCU*shbT)&X;=;CtB#PUeh
zuRPc~zj~@;N>#^-=_(!hJ_p^b4bSd$#!*XBY(m7w0qOrF(=cT~tG5QbXVCjelC45d
zr6UiWScqu^cXp>?aN-f|i<L&)CndA`{%d!>l!z$@G$XP-Xe{<vk5qPBj~p~~8_vKm
z@l8t~x~@5lZ`L$|=Rm6wZ`<ux;qiu9xsnTCYTpbj_Mq1sfaMU<gzgnK;ptx#hbk=F
zU5{^zbfaMht1PQK$N@%qIw?5~`aav%X@qsEXqIM)gE^Cl7vB|mqMJ2l$ZQIqTDXCI
z`9mY(14%l#rdNvvM5W1;<zUgmX@sc~R!amJ0FvU@S+OKe3afwrkfe|kU~@5Z7%I5W
z&2RtM|CbAWzW*M?6j;Y_333qLp8ji(g*crZL*N5T{Cy_3kXNOQlVZMzv1-ZW9W#4E
zK3akACJjq2Lwi)!meg**^8c`r9Mxulxe-7L^k(QVb08~upBEo<ES)jBFUXVWKl3h&
zG=)Lf2J$JT&Vg&E2O{!|mo$YPx0ub!gw||B+1fUrazSwW$P<_VK2F+8R1oO$P`NfM
zABy~x{QkQ+3Lo!lXNO_a)xzoScU?U^E`_d7q1hu{J`&6<cE~5C2miaEvKE(F4W?%w
z`9VJ;Jx-R(PtF0*na5dHOe7~Qf$$(kTRJ8&mCMpxZolk1rRFy-p7~@UjnNwq4x+FZ
z^nZ)|K{$HnNb)WbvBDw44Wr+=-#by=Zj*TGDVccLgNw-u$EJ)r%;4W~Xd=X@=!Q+|
zOPip`z$J9OnAl0k$ogvtWECRzFyfLpmgKeK&)(jiOQI;IyqKIsk>f-WR@P$*pCg`M
z%%aF6KX~NNuB(et)tTF68pYFTg!AS!DgT)4aanLhCv%Cr&AQr8tHzQ7M~ectm*sYX
zult5dF<We>*pD9hi7D2pT2@Xo|1^(F5DyTs;to+T2(Stq{M{cpMo(=jSx_Nak>3!A
zaAED23|bpmVnWUgn<pQgDjq4gwg%7)$W7Qf$0aY|86LZ0)zj?RD-KT*dl<3WDnMPF
zr`X$AeFkjM%-nZy0y}HGo!V0~n^Q46T!#;F#QMdHL-`#DFR2qRJOZ5!Z2X|X5%8Wf
zV|_drtpHFpZH7VMmE=?4WNoC@ObN{<#VV&&#WJab8iDJ9b>$P=fInpSPHe7*!B2;*
zi00gR#4@`lk<!K58zcPv_p-8PMMu!mGAFRKTIIIpeC&@x_64V2IWVG|r=ZYnVZx@R
zl}(cgYG%VQLj+Acgq*<xJBoB=SR%Xt0{E^K{0K&InIEVqi+_8<Q@t-dSP<(#c!5do
z`7Suo?sME`Rafp!^<}c%tf6ihm=d@<#^8Q$Tv=nDg?27_?;SARsfhO^TX6xOluSa$
za#t5ZFpu0ldxdD~amK%rZkN0uU9an!zGKq;dI+?v$!)}<S(;Cy>(BMDvK^G}vUa;=
z%y6cwS%!lZ543P&xf2s6Lmd%E87n}tv6clcep4rmztwJ4SAv>>F@JQo0c{)1LJiNV
znxc8coiRcotlU#^_1$G|s~U})E)HsXey5fsdgW3EZngCZfU00>iE%3t6QP#_N>y1J
zIAPG+l}a%BtmV$$Fi(RKI{#gLgK6**x_)&5&pQS5M)IZ7kcEziad)`0o-i79E#>kN
z>j+n2tAaaU)!|4JAxaq;O4kx;9?OGkHeRG1n`vN^Qzf*(RDx^ny5zf;Y@_V#?1+w)
zHPJW#mfMc4c4wzDtpopUh+wGq3cVuvJbhQ0r)N!Ba`WMYUN#uFG&_Ae0(}Dn>6M0^
zfeA++Io~3X!)@8dBaT?iQ0>6fdA`f9Zal96ua4-~NAnxPtNPyC7$n}gIwX2PIHoq7
zYA_}m?iY%!2~BV{R6R_ZycU~mmsL<aZ?|lS-d}wt)?)QBrKmAJU2F4Z+e#ATrSOQl
z#TosU5SWT)JNl*fv$eu!<z+yx`$g0lJQ+QauNVwLlf)!M22PEk8=?qR-(|T&rWp#o
zL_0%Z*~lr`+uN#4qT~}yS>9G0W6^;wGTFBQnqZ|;Gh|cbi1L>wjtBVDmSR|?ti{T}
zn&tjsV<%aQ7Kw@RoK_$45^PP08r%3r_tBc@qgGEV@(pD?1%GXYJPClTlWbA)$Pmpi
z59^IvB|N=eCh>a%8|`|hI;5%W1$?$TtZX`=5shz}OT8a&AzNs&8go-+C_Cb+XEw4-
zE6}C|J>Z*-!0XD0mbl#OiUr<9j5FH@H&h%KYK0lVfioegiEAEA|L?f|wMX246-GQM
z0m5LVr=^mK-N(!eKrG@g65vRDT)qA%gwT>zDy?>R&(ckdEkCAoa;qlJl{G#X$=SZ(
zK53wXy0+vhhtxpErUtOAcMuIPqww9OA3=!Xj|K|eo-%mjv;gG*<T~u;711Vu?CEzP
zaN6&k0TsMf*Xy%%O7~qzP;9tF<<=s^+OEXqY#8e)%AFm-s;hMY1z;AokkjSSnpkt%
zqT<N!1*<JEw@UeXkxsQ!JKAM#COUP43;*KCA9aEJx*J;7m~%h4i13c$S<Art-qErp
z;)H+xaSiD$?rB*xuLk4bY~Y`4BD&pOttN5rEv$WGt5I4>Q=qP1<1eu4B9D^@pQ|Tb
zaybg7KmSO&<k>6zl{vV&$)m;cY<Y0`?li8t%id`0N1@X@2w`=(e9f^;48w_(!@)x5
zHinCSH5}DCAAhk0uQPw(k9z$G@2w8bs(hOn3Y1B*geIT1XBGN=KlI-|fK}xPd>dvk
zEqGzN?>~T@aXh~btKo6zhYw(*E*xyb1Uf%}g}SA&4GZY}02Y-4`fV6p4T9JHX#60r
zvyS$+VfH#02M==teJ5ZmrJ(l%m{jhk++)cGfA>$K5O$XP>2$m;8|Zp(^5PE9R^B!o
z_Wj=AUh6VA*=juoC-<R>S2bQV=^`&Kv0Z=N+32P-E?u~*l41Go&IJn^$nG3F@Jvdb
zjChz-iJ0SBoJjGQV`p9MpT#5QY3;>j_|6Pa*2jRRIawTX6l{TTNKU6KTn3$lU-Rv;
zd(B0FT`qdE=<*mBLNfLbixmk~Df+c}MZm4>&^lA!DOPl`qT)`ijInnbs#tTjAqyke
z^-;?hPjw9yECRFeWXf&<;k|nZ{CA&&nDb|^K43C3uY|D8oY~PwV_}xLoIJ2%!yj~N
zV;|h;975WodOE@mZ$LMkO_A8Lz{6ozkjSq4BwM-UD?8l5>~uCc_~~FjQkVE-7=3<p
z8jVhmu~7&6ntkQag(-^Ch(oOVn`-?j(S{Qumg7I_DG}xiP3J=`Km{4e5l;rJqLHi{
zsr;xuf52v$nC{&Y0?IlHgDnGE9<m-pLY{n-_l%5;N9NJs{z;ali!#NuX9r*OOY>D?
zcHu`+K(hh~24NO)M=VckxUJ)g{IO~6GyP??#1>VQ%_KqdOu*`>@TI8?$j8)59DGtO
z4d!M(I_H@=`(P9<RMFx<k!I6s5RxF$GQVMbW8|UKm=%xgCYilQSZ{9$F?YcxqTr5e
zNtAdZqad|Kv5cQNR)-3RRudpCZ>3mzdMa;1a4y!H5Y<gY96WaM!s#{}2z|f?Le&bh
zd2`z~Ix4m9mB~ri#I>{2@@|~u^i<50C#F}<Ap2VtItVc*3HGYmw7^pfkt+2R#l@<j
zVErWQok0`;IK}>RQES#V0URvl2^h@99{kUqxx5`XgVp9Kh1`Ivq(zh!D}+(V(k>X3
z;`^b3HteaZq=`1ay2u}}PJ-EXbsYhpa&q}MZs_%BN{6!-4e$z2`Ark!ghQ8vJatBH
ztTuBQwlCTHt;v1msEo?fr}eQ4%_UZJOW5o~-q<xT(YR1)VR8i4ZpY=O<@8m*SNGWB
za9K7&$2Q`9sq9eDTgoJ6j4fQgv#gW0y5Ve=j>iqmKGi*_6)frpCg7Sbk@YMdT#Ws2
zcv>x!)y`O&#{FiDQ|~UW$3Tw16&N((_YX%x{>@kr1}ZiqVWpVf5T!Mq=b804g_sIQ
z^v2x+BmBhb56>jmWslT`nKjv?m5?GF$@q?6)f4oR_T8CTZo*XNvF(#j`Ut>=5qsly
z%zJLGgKz&X=rW@2y?68nMY{%;Yt+_pa22W7N60E!sX1X=^voh;!`7G{8Sylabj8^9
zJA?{8_g#}&^Ey@&Wvyj1t8HD*?eTIu^xrcFsLJtZslbDB0Y2z{U?qQ}z}yw8c>|M4
z_2j6gC$SO8bOO;*wLlD0??hmF>ygzSOYse4ldBS#W$|@lq$n6piBFY7yvE5<tr{DR
z^hO0*Ycn1*3W9mD7Dj^)o9}!`{rD-R9N1l_j?zQ>_lD{J&)0VB%ed<+ISuojWC{NA
zPkU7d@t1+`{&uGN|9Vcno^yOY432$I#0_>CN9U4!8K{VXwgwE-WEQV7`a=AI1d%@>
zp>GGulB*!4E3lPo8MrjXfqh9=*QF!&{Q7kZd1XQ?&P}_<LlKQ;t9(N2djY~(#qfVp
zNB4%n6QT^4{}b_R<4ygh3G2uIS<^2|@*8^V@_*L!!(Y~N@vk*~matO5#a%RLwVN)E
z>Zi;rgprJ#-2A(_k<XHv9<_m_b3A8myTY~Unm>#4C8=2!-`MZZiC#5-08c2b;&t7D
zHvM$Zhj?kBza2%%Fsh{)cEmNU3Uiv9D<j2CA-n$rZVgp$%GTef2c7hb^0)DaB(mdU
z@dA;$EsU=v2{Xz0s#Oy!_qMAyfcWR8GGfEsAi%(s|L9t*UQ)*ENO;#s+_t(+ChxHm
z{*qgQ*O+1*<BMMsl9$!mZs=8;cyMQC4lMyV8`v6yH&m3XCO)X%hHE_QvR}%=!iaep
zj&1wK4KF+dG;es}4K8`hi~S;AUa+6AgUyuuTC0VaNsO9e^EEGg%b?57TCCHSrt=ma
zW;tSMpxg`bV~l+9i3ZnI=P#!b{_>nZdhHu=nr$@Q)$jL%%W*I^x^A`Yo9}k<*W@}P
z*t6f%z#yAu#x-1cP<=-Q9vN>InXjlQ`_F*Ulu<8cq*yJ>B%86_St1H>RqIffbBtE1
zua%oGUNPBr^!r{)R`&Z#oo3j304z6v2A4(|#<-d%j$=3Dv%+)3`&&S|G!G+mMpDYx
zgRFK@R522ceUV@^Mg@8wgy;H;+OdVbRNy6UVtVqPFl^Z@RN9@!G*(Y{@n2()HR1^T
zOWZz<*rqL5(PH6<WCle39sdR{jJzi89vb_$v9YTSytJ~I<|le1W9|G}ScF*jD=VR0
zo<_ZXfA}WCYkoYSzOVUIVC1Yf95?PanUAy5ru$=!wuK?M4*I(a>Kt3!E%oEWwSH{q
zBWtutC4>_FO$3(CW<|ILEVBPY<-d<>is;#x4E!ZlzJ_VB<)kno){5msfWTv@wociv
Go&N)E%tLkn

literal 22737
zc%1EATXWmUm3|g~MGv>+02)}9CYjodwc{y@f+SQZQbR(%B$+}W5|mH|0g7n)vL65K
zea<<3ZxA3UT9c=pN@Nn<eQw?Tol7_P;-EziNVk}OUZi*TlsIFT9RKvwf0O6rhohq(
z$={awU6$U(Buw7tY56`Tm;ZNHzAv&k$AQkU_#9^>$V-~iB~3^%g`VU4yvT~X&mI}k
zV*LKT$Y${IV=_r{_YjA5vWzf(C0Qh8viOip@HsYJ7Ymved0CMOg!zed=JPB8X5+(k
z6o$zpE$Je?T_Pb8=M%Cl6O!hnES8IL!k*lwdA#^crp01bdgNnD?@6&>{}xM%RA$8_
zou=a$X?P@FBxIf}W+|n~gv=MkhjaoT=zUD#PXctZtoWGbcVt}Tlay(IRB+rZp)ZAK
z$A=Z^N;H@dYg|mA^RlF%5sg7yBplxsAFxT-0*SzXc|p^0;z5tJBpJ{{GMY2f&=w1r
zj<YzOB@1b$A68`no`zkdETHXV3G)3h;t;N=pfoAQ%UP1sSWevwn3V$B7i1RGWRb>M
zsm;%(4GEiSNd5kNNcu_2hGLgIp0U-5pY?Lh3*E}*B83G7l5=Xsq7-t?;?LwZ!F2?h
z6eP(f(3aqm0bynZP~ujC(G!poRwJ201Gh+7OzB5h34)ebWTc!YV_ae|G{v>Iz{QpG
zWmcAkCgEi;BBQ~1_@*=T34FdD4qgXm{uw!a2aWKkKMI5JCiF?Ce@424emD$HZ^FTF
zME>=!&IpG5=}*|iwqE}o@!wt#{n3aFh9tPU?gc;zNDn*xFz`nnkn8qt&Vv4hM}P|H
z4?@xlu7VJ{g#!;cBB9lhWN=Qd{9*SJzIIN7UJ$-x0-Xn8AK9G)zYe+X48x#%)9Vb$
z_08~lFk;kDv$J5-?RA1H|Ll-}5WtxDul;^VMwgvluc9f?vJ^e_LCDT&k5OZsK+&^c
z=yyZZNPp^r<v_k3Akwwp4e*2i)(2%e!*`w_JMw?Mflknf)Xq9roeNOU*<cu$mhR2a
zze1706r-C{DeT2ya5h3xKz`&8Uk6=(bV7QA5wqFN$oGIr*kSB}3K$HU;q&RuC}5@w
z`k_A@-du;lpzk7~%fTD44G7zT(PzxegFe$4%rqFjL%L`WHVYnkbLqqLAzGDLt%J50
zf%Uo}QZsr2SFmSjC`<bOMK8GU`(0-B0TOx>jC>a+Ef`^kfOCG+dB=3TVd~>_fo%Mv
zv4A}`sU$cjowL^g3NJdtQWynd*$mE+(&(mpDXfos;YF+UUuizhmVlG(yCjdYVw@e`
zw_B|e0b`6C7qDl1A1}y3`FVC*WD#y`$9(RIUg76?LJr&$Irc-5P6!Z97JxGmO=k0q
zeSmJY<N3GB*R|hTd+;CZf6mzh;G_Bv2vVm-i=qG#SH_a#HZBuX&en&ztuHME8E_%X
z1t9D5SA6XAS7<OCaMJo(&kCeS?vlk0%+e`wfYU6Q-6o6DZS4u}Z6Mh`AukTd+qZ84
zG?z1Q0R>JZj!H80%6#Y|&hHZP^UtJz)9V=o?vr#D3BlSY^}~QM_z)Nin<Tn|wfO8A
zG1}r!s;%?3D%%E%N42zWR*5b1GQG=_$&M7aBlxAY2mW_K9hX1E|8Dw2zXOO1z~_ju
z%!Ith*QU9?Es89O^W7JgFdvYwrC*F`LeVGZci+H+%|0U)aa!%h#akv1%OoFv!&Z^K
z8d*>XSH3|RHk>wVK;v&Pm5FwG1n&OjEh329$d*H1_B3-Ph;5uLh<G5zyUmiPVXMe(
zWSqu7J`GDCw2|3|v`n8&M?q{O(<Pn$^=UXFrH$-vXY;4w281^2mP2H{D4%MzDsmec
zLu~NPFqTf%STWrlESsFK#<Nvhr#7IXPzy+22&c##HKGRopMBsoOrabzz;f3|SWL>C
zlC+FCA7IMJmjC#T{7eMbFC;v@x*jpHJW^d(9(c~Lp6ZxV)v;o_N=NSJpqu6J>`oUP
zwIszlM64Z<{%<k~QwFr!HP}6a&X1C86?!Tid5ptiK_d#YI}L&}kLa~nX+%FMnXUR?
zyYsa~OgW$)k?lbv;bT2g@wOg0uIV<If??vjhCXy%a~R*PX@r#ntwvyMx8H=_4YP71
zH@?)q9$4%_uQ>qAA*2r7D{R8^zbXz@Shl-%?~8P!Vf)K0TU{W>80G2g;XLU1%&pT1
z3rf*6%@PNb8xt?SEAm7)Ys`>o4?eYU1N-uaM#Kk_v~W)^=W~cklL<?fqPbHGQzh({
z2rvL7#jn$1L7WtJ|IrCa$^WqCV(Ktda9^0;{&Do13w^%-9>f$_$8ZV4X5OCucF01U
z)}A5ou_gWylUvBEa=URco5xsQWb%%fJt1+dz;~U7C6}Q&s%pwUH(>dH*hr3Qv%uU4
zAO(6ebeKAjmAuc3k2%)37~Pj-fAY_~%_2=<5avKWrPMig?esuIe({2);BkxTv`pxV
zZ7AE@=2I>Rx{o}83E<<Ty+o={7bj|IvpSzhB+2i;o1<9%r58I4n=I!}`>5^e;c+Q+
zeFn`QY4ed_X5k_COAr3<g34N4W;K|eBjgADj6613EIv8MKxY<bSuvKJv;<-WG1_ur
z5>vS>&87Qg-zhb}aq-M2b7_pusDB)VouKz?<oCnjJ4cdtiHH?W7;YH-F8$7#>UN*R
z6Hm#+>l0i|R^c^e)L{nyjzbe6MnyMlQeT<`MFuXR>&3)QLPpkKLm(^Vu!j+s#IYn_
zsnQ%C9=aroV#=$&NfbFw6k!QGrtmr9`NcGfJo1A_{_MKCYE+%M1Ex_tnM62mPMz{k
z$sV@_S9Cm+xLdEQ{j_Q<DR49|(7i0S6MWq_REpVRJH`Iuksq02t*T|^H1kihxCHS4
z5i83f3i<(-YlFZ0L&xZ;O(hE|BrEbe0ue6k{gOdzElW(unPKzfqf^Br1=rR9ngO{n
z+vm9D1w6xJSL}M4J%7dFNn#Hpwz3OQ7v~xFHg=x@8#FWh4o+Ze&1$Fi)J$ho%nsM#
zLmaVw@%%)72f_>L#B+~8X9F8QXmA9)=ge3i4@N5hR85;<5O^i|1UOla)S4-w*|=Ed
zw5nJpbx<R4Kd`QRVr%e+96Si;Y8d={z=~+jgGVg0dlD&Kti3V9-+wPFYgTjwEe&%5
zTdPrSYtBdhFl1kF>eT{9bn_Gxx(!U&v^27*Gr@}4Fw77^6AvM$@W75DT^W{$RR95e
z+X{XJqqxkERg}fQ?ekRc3lA2=J`k(GB=_O~7SX{AbhD}}UrnpqWV=~I-7+vGaCeNs
zz0Rnz$2<$|TwJ{mz;v%7-hQ^^0`8YgLdROJE`(qnd3gQ`(bVINe<AHQc}dz{+cnpY
zN%!js(6T1C7K^57K8bEWuZES)p!AS6+bv^;GnblWIN0$(3mwaYm@paYh&amF0g{ci
zEpYRjI$`{+yw$1_)C`RIqlXP>TVob#tgNaj>PI{nBNW0)pNhNhA#)qmsCBwHsP6fL
z+LE{`7cy{L*`ENY3Z@nqw-PZCdOM(0m92pj2EARW1f$Pd9&Cqs9t?5uKdd^KnpHyA
z?=Il^pn%>;zEm1A*YPlVhX?Bkqp_-`+&*F-;Vx`caPO-+9H}EjDI-JaS|ashd2r3f
zi?m}i4Qz6%gyxt^aLrwpeD^bRl&!rz(Xp~8Y6rk}+q2bf?Nz3=@4pQZ47IP&JCe`S
zca?d1UY8};A5Q3PgK<m!qHji^Z-5}Z)37rz;pijhTLg0GmTf%Zh{X)m3{0&T2mFr3
zixuG25&imTenWV*>U(R0#0OW0L_36I%HdRlG12h2P;5<Tg1e!*!lcPpVw3H%3W^8g
zmJM<BSD%T!Sba<>YK%|U+PvPjk_7o#tcX>MGx`l7Fcr;q^h+OSYlY8hl>xo>7g1;M
zWb{P7VlV_v5|a=aI5mcDh$2*dm*ozbW+?O$?F@lsBd27$w`G|`$tReyys0?Gq61xI
zvXAZSV5L$sWK-mb@|P!$2l&&5VpyfD#mc~%<<UuPCs~UYiHY%?Rv+;a?1~aAY~wrK
zM{A;wT0O1EH<a-d{52KwBmlBbvPH=wLo~xYtT(z!czU}?;`atN+VxI#NK^3ze70Jw
zY&xb9jqmD9y&vx(Td1=dTc*lTcEq)s*~l`jK$`~ifNwSeuPY;3;__8j%<<A-oY`w|
zL&b5fc9;PiI1`eZxaGn0|Bmaw@`$frg%SHDKp5=wv{W*&i<5Z)h(#Pm0u~Y<w_1M`
zLTJe<l~%jEXXz%!mLF3(zE>0H${HVx<ZNH^HEE!Ox?kj~1*w6IO$}gK=QtW%N8!6`
zKY|d&ANCcxJ!A03X#vUs$hFuNDWXjP+0*Yp;Jnwl04jL@t<z)al<qs1pjdO;$z6#M
zSG*FJvu3QPD7W?mtG3n!6o6USLQa=QYhur7i;5$^m#ntHmQ~94i(FKDD@VI*nTbyA
z;L5)`^@nXBzwRoPHRjR}t|Gilc+oKMk(a4#fwrN$@k*6N@}@ruF8co2E;P3!DS%OL
z!<SeXktaTcn{$6cp1*>>e9@`fHChbM=8s!yuXZO~cZMTB3Z2ez2rJ&@`+#Lf=;Bkp
zMdv!-FqX|%WARvL)-Si<b>a8@VW$`2rO*CFm2W*mvGbEGp~<K1S%rSj5B;}0u&NwO
zZ^P^wc!YTUZ3lM7k@+^P2HnsPcVMF~0c^trI`6<j-JIBl1$5qlMdi?Z8%8(%;I%&-
z?X>Ew<MwTsy$(jfZp%QQ({H5|^xlC<<<7_>wrucs|11gt?H{L8cUv~l_0i<Ty_&67
z+hEZ1JN-xP%iwIQ{TQ4*hALj4cv+{5yiCMA@w)TMP3KO!m{ujja?rgi=E%vx3_I}b
zMx9o8nCOT&;8vUx@i<^_T|J(~2<8du)phvJ3>wzQWu`e<Y;YQEfpADprx08QofzM8
z_t?JWB7m2R_UCOLcS4xN{$cSOp(<^@HIMDxic8kn^Iox}^CcDcTxHz5S5sM<F^4RS
zVAm`yV?5J!O|S^e!v2Ka%)v|R5R4zZ05NCJUwyy?VO9w%>p8RIh}vQ)TXOOci4EWB
zB*i{V(Q&=BNA<*l9jJhAIGZBbWPyjnt_6_;cRyRY<SRRH!HjV_KK}9eC{h>eWN3SN
zdL9kWyV$4$aLvAQ5W*BiX~e<O<4v{x<YvRE4a>Wq^yCI(__{Nj2B3m0;gkpHRv|~$
za#YT;I)A`sk(kT7Aq14Q4F+2VwCu7UM3S6*ly`rOEJWtEu>6xOOXp>ZsmLC_C70&Q
z#O%V4hk#}U5)8sD#Ew|*RC9yI6**nq-e>yD3WhDJC}l~4W}V*ZsPLt(G{?uRlpXk_
zS{lsE9C608W%j`+Ca6Nfu_Dc;)gUB6q+xy`;Wu(aYRrm94wB6F5!S0uLd*lOi70~O
zUJ_-O$S4wRQNZHofYqS_qSXXQ%Ud~>o}S9v37m`dc0$#Oh{M1(UIN|5fzTZs2vs}G
z=FM$eyHKfh*Go>qCa$f$h8N2ur)OfOJTbj;2H9U#d?3V}B=A)$(*jQ|M5@#{6c?+m
zfi;b=a{*BR;1v6xi(0d`G2mb+Po-ck4&ndonakUOGgxhwQpgRsN?Jr&MM4;bEbWRx
zDZX4OXoF8(CUvy=bwd7tbrQ_BtF;LDl#|Q9aYL_1Q#zQwtbtc}%5Q%drw+PI<Ee9N
zW4D>xuzAZqZciSmh03Trd$u}Op}EA0b_vct<c)0u6OBub7A8kv?PgrA+fHBgt8Py%
z4wq#kbZjHumx_mi-clwpV{GGc&$3S1s>9hV9giEBeX2gF5iC{@F<@!BL>91ka53`3
z!FjbTwsP)KH||$soO+*dJqB|8t-zoOzkfIq@^8k5Fi^1`2`dHenkcRIjLodSDa2Gb
zq8)bwjPO&WKRlCMmpxJ&X4YhnRziw!B;z}NeNNCzn!Pi#+?c7%W83{tx-4(Qi0!x?
z^X{4JEaC5*E+Xna+N19j?HX9FQCr8sRis`YA**C%Wf3+-&n!YVY>nxW5l{0-SBzcn
zAyn{r<eJRt_pzENYcHEwZR2)sj+dLE|B*RBRgNc11$N2>_@Kvum3+b9^a|CyfytzL
za#YikSPNu2foP~&Acm>;6fnK@$nub-_y)4cT?x#x_%<<86bz@tr^>-v?c}Idjg3Zn
zqXMn98IKtS!Ms=-qh<}8?_o&&_{pIh*j}fO(nGKB4b%UhukF|uWY<@6YUVr168zbm
z=Bf_jF9YAB?M(Im^_<muPWN&UbbU|64R#qv=aPIIsEC0!1`LyA8ZR^YQv9j|kw5F8
zZ|upEt01K-u$8M4xHZKgdP$eJr6YX)>J<oijX^8UO}l1=A{tGX`Iy*e^<uG#;s2zL
z?hSz_L>VssC*oJR>-tR+){p<QreBuicl6%n|E%eUKTGA}pEZ3Juv1`(yJ*mAH(ean
zPuZ#vMly18^KX44pCvUt%7LUaJXmhJR<-HsJ&W@tsc9D9+3&Q8UMuSXRzhhNuU8k)
zrr*8!5HBqBx1%T-Mm02pM_kjYFsHt`GE&^$vHS0Elc#!nb@d&0&`H0%ejk5GB0D}7
zFZHM!y!fh+Fq53Gm1<(;E_L-*4*y(NMy$E70~na{Uo4B&i^F(D2=D)h8&LPj_&s*Q
zpFvCTYEi6XeDO0p@&Z}Yt+{Fw5AMv&p&<Zg0~=%Tnu>DO#K+YeYPDxw_KQ+j7%?xX
zF}H8ry23+1^VSvKs**Ra*w4x31^fLsaHiy!m0F0I#HcAYU%kSc|7~{GVx6|sowx8X
z%Mn`x<(`XQGUS_2G`Oxhe>sovXWRVYYu|{|Y@_L}ey<l?kAjiWbt|`TzHh}}U2BP8
z&whIXgKU}^S7YHp^}P{zWW4QTzBZ!lKLth;M!lGlV!0@jY|6Z|L=@nv_MtB47_C%a
z^)_FIVzTY&cd(SK>^G5G^{}@CEZ2Yrmqr=JxGpD-V>jco!gFKwH-L0$9!BVlq?E7h
zSnZ;yVk8_#BEhJQ3bY@D=lYBC*uq{a@DjHpJ$ZK*Ts8}p4kj^;)zbs~*YL4M9D#qt
zjnIfWZNZ8bb4MgIAoB0{7q~F;nzVaj_-(_nD+gX$Sxo&C?Z{X=zXui}*8RdtXxHaa
zr`H?2iSX(j52zn&J{1@_>kY?^`%UKKthDL=Sfg!W2(E+vu7Wzp)^<z%_;9Ts8~Vf=
zZBhxLM1K>3rL$QPt^tee|4{iKvouBYY)l6Jj49v4wAgY|7!hm7aw0(BDO6jh?AO-6
E0frY1tpET3

diff --git a/crypto/heimdal/lib/asn1/lex.l b/crypto/heimdal/lib/asn1/lex.l
--- a/crypto/heimdal/lib/asn1/lex.l
+++ b/crypto/heimdal/lib/asn1/lex.l
@@ -255,7 +255,7 @@
 			}
 
 -?0x[0-9A-Fa-f]+|-?[0-9]+ { char *e, *y = yytext;
-			  yylval.constant = strtol((const char *)yytext,
+			  yylval.constant = strtoll((const char *)yytext,
 						   &e, 0);
 			  if(e == y)
 			    lex_error_message("malformed constant (%s)", yytext);
diff --git a/crypto/heimdal/lib/asn1/symbol.h b/crypto/heimdal/lib/asn1/symbol.h
--- a/crypto/heimdal/lib/asn1/symbol.h
+++ b/crypto/heimdal/lib/asn1/symbol.h
@@ -78,7 +78,7 @@
     } type;
     union {
 	int booleanvalue;
-	int integervalue;
+	int64_t integervalue;
 	char *stringvalue;
 	struct objid *objectidentifiervalue;
     } u;
@@ -109,8 +109,12 @@
 };
 
 struct range {
-    int min;
-    int max;
+    /*
+     * We can't represent unsigned 64-bit ranges because max might be
+     * negative...
+     */
+    int64_t min;
+    int64_t max;
 };
 
 enum ctype { CT_CONTENTS, CT_USER } ;
diff --git a/crypto/heimdal/lib/asn1/template.c b/crypto/heimdal/lib/asn1/template.c
--- a/crypto/heimdal/lib/asn1/template.c
+++ b/crypto/heimdal/lib/asn1/template.c
@@ -66,7 +66,9 @@
     el(integer, int),
     el(heim_integer, heim_integer),
     el(integer, int),
+    el(integer64, int64_t),
     el(unsigned, unsigned),
+    el(unsigned64, uint64_t),
     el(general_string, heim_general_string),
     el(octet_string, heim_octet_string),
     elber(octet_string, heim_octet_string),
diff --git a/crypto/heimdal/lib/asn1/test.asn1 b/crypto/heimdal/lib/asn1/test.asn1
--- a/crypto/heimdal/lib/asn1/test.asn1
+++ b/crypto/heimdal/lib/asn1/test.asn1
@@ -7,6 +7,8 @@
 IMPORTS heim_any FROM heim;
 
 TESTuint32 ::= INTEGER (0..4294967295)
+TESTuint64 ::= INTEGER(0..18446744073709551615)
+TESTint64 ::= INTEGER(-9223372036854775808..9223372036854775807)
 
 TESTLargeTag ::= SEQUENCE {
 	foo[127] INTEGER (-2147483648..2147483647),