From 14d458dd78b092e4b6ed66ac9c3eb4a66d76daf2 Mon Sep 17 00:00:00 2001 From: Martin Whitaker Date: Sun, 10 Apr 2022 21:34:30 +0100 Subject: [PATCH] Handle negative OOB access to local array in constant function (issue #674) The word select expression is a zero-based canonical index, but the expression evaluation may return a negative value. (cherry picked from commit 82caccd4ebf53d9c0d726436606c1a7c35f2afa0) --- net_func_eval.cc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net_func_eval.cc b/net_func_eval.cc index df4fad9ec..81ae093c2 100644 --- a/net_func_eval.cc +++ b/net_func_eval.cc @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2018 Stephen Williams (steve@icarus.com) + * Copyright (c) 2012-2022 Stephen Williams (steve@icarus.com) * * This source code is free software; you can redistribute it * and/or modify it in source code form under the terms of the GNU @@ -339,7 +339,7 @@ bool NetAssign::eval_func_lval_(const LineInfo&loc, word = word_const->value().as_long(); - if (word >= var->nwords) + if (word < 0 || word >= var->nwords) return true; old_lval = var->array[word]; @@ -999,7 +999,7 @@ NetExpr* NetESignal::evaluate_function(const LineInfo&loc, int word = word_const->value().as_long(); - if (word_const->value().is_defined() && (word < var->nwords)) + if (word_const->value().is_defined() && (word >= 0) && (word < var->nwords)) value = var->array[word]; } else { value = var->value;