From 0ce22cea465939ed0b2c48cb21ff07340aefbc49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcin=20Ko=C5=9Bcielnicki?= <koriakin@0x04.net>
Date: Wed, 27 Nov 2019 22:24:39 +0100
Subject: [PATCH] read_ilang: do bounds checking on bit indices

---
 frontends/ilang/ilang_parser.y | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/frontends/ilang/ilang_parser.y b/frontends/ilang/ilang_parser.y
index b4b9693da..4e0b62edd 100644
--- a/frontends/ilang/ilang_parser.y
+++ b/frontends/ilang/ilang_parser.y
@@ -430,10 +430,14 @@ sigspec:
 		free($1);
 	} |
 	sigspec '[' TOK_INT ']' {
+		if ($3 >= $1->size() || $3 < 0)
+			rtlil_frontend_ilang_yyerror("bit index out of range");
 		$$ = new RTLIL::SigSpec($1->extract($3));
 		delete $1;
 	} |
 	sigspec '[' TOK_INT ':' TOK_INT ']' {
+		if ($3 >= $1->size() || $3 < 0 || $3 < $5)
+			rtlil_frontend_ilang_yyerror("invalid slice");
 		$$ = new RTLIL::SigSpec($1->extract($5, $3 - $5 + 1));
 		delete $1;
 	} |