read_ilang: do bounds checking on bit indices

diff --git a/frontends/ilang/ilang_parser.y b/frontends/ilang/ilang_parser.y
index b4b9693dafb030db3c1839139332de2b049360bc..4e0b62edd9426b2057e595d34e2e716a7c76a46c 100644 (file)
--- a/frontends/ilang/ilang_parser.y
+++ b/frontends/ilang/ilang_parser.y
@@ -430,10 +430,14 @@ sigspec:
                free($1);
        } |
        sigspec '[' TOK_INT ']' {
+               if ($3 >= $1->size() || $3 < 0)
+                       rtlil_frontend_ilang_yyerror("bit index out of range");
                $$ = new RTLIL::SigSpec($1->extract($3));
                delete $1;
        } |
        sigspec '[' TOK_INT ':' TOK_INT ']' {
+               if ($3 >= $1->size() || $3 < 0 || $3 < $5)
+                       rtlil_frontend_ilang_yyerror("invalid slice");
                $$ = new RTLIL::SigSpec($1->extract($5, $3 - $5 + 1));
                delete $1;
        } |