From 3be5fa053f61a29039ed99876d3e89406c99cb7d Mon Sep 17 00:00:00 2001
From: Clifford Wolf <clifford@clifford.at>
Date: Thu, 16 Oct 2014 00:54:14 +0200
Subject: [PATCH] Fixed RTLIL::SigSpec::parse() for out-of-range bit- and
 part-selects

---
 kernel/rtlil.cc | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/kernel/rtlil.cc b/kernel/rtlil.cc
index 28f0dfdc5..5a94008d8 100644
--- a/kernel/rtlil.cc
+++ b/kernel/rtlil.cc
@@ -2980,7 +2980,10 @@ bool RTLIL::SigSpec::parse(RTLIL::SigSpec &sig, RTLIL::Module *module, std::stri
 			sigspec_parse_split(index_tokens, indices.substr(1, indices.size()-2), ':');
 			if (index_tokens.size() == 1) {
 				cover("kernel.rtlil.sigspec.parse.bit_sel");
-				sig.append(RTLIL::SigSpec(wire, atoi(index_tokens.at(0).c_str())));
+				int a = atoi(index_tokens.at(0).c_str());
+				if (a < 0 || a >= wire->width)
+					return false;
+				sig.append(RTLIL::SigSpec(wire, a));
 			} else {
 				cover("kernel.rtlil.sigspec.parse.part_sel");
 				int a = atoi(index_tokens.at(0).c_str());
@@ -2989,6 +2992,10 @@ bool RTLIL::SigSpec::parse(RTLIL::SigSpec &sig, RTLIL::Module *module, std::stri
 					int tmp = a;
 					a = b, b = tmp;
 				}
+				if (a < 0 || a >= wire->width)
+					return false;
+				if (b < 0 || b >= wire->width)
+					return false;
 				sig.append(RTLIL::SigSpec(wire, a, b-a+1));
 			}
 		} else