Fixed RTLIL::SigSpec::parse() for out-of-range bit- and part-selects

1 files changed, 8 insertions, 1 deletions

diff --git a/kernel/rtlil.cc b/kernel/rtlil.cc
index 28f0dfdc5..5a94008d8 100644
--- a/kernel/rtlil.cc
+++ b/kernel/rtlil.cc
@@ -2980,7 +2980,10 @@ bool RTLIL::SigSpec::parse(RTLIL::SigSpec &sig, RTLIL::Module *module, std::stri
 			sigspec_parse_split(index_tokens, indices.substr(1, indices.size()-2), ':');
 			if (index_tokens.size() == 1) {
 				cover("kernel.rtlil.sigspec.parse.bit_sel");
-				sig.append(RTLIL::SigSpec(wire, atoi(index_tokens.at(0).c_str())));
+				int a = atoi(index_tokens.at(0).c_str());
+				if (a < 0 || a >= wire->width)
+					return false;
+				sig.append(RTLIL::SigSpec(wire, a));
 			} else {
 				cover("kernel.rtlil.sigspec.parse.part_sel");
 				int a = atoi(index_tokens.at(0).c_str());
@@ -2989,6 +2992,10 @@ bool RTLIL::SigSpec::parse(RTLIL::SigSpec &sig, RTLIL::Module *module, std::stri
 					int tmp = a;
 					a = b, b = tmp;
 				}
+				if (a < 0 || a >= wire->width)
+					return false;
+				if (b < 0 || b >= wire->width)
+					return false;
 				sig.append(RTLIL::SigSpec(wire, a, b-a+1));
 			}
 		} else