From e7e663056a0573d98274464eacc5951d8d0f227e Mon Sep 17 00:00:00 2001 From: Lars-Peter Clausen Date: Thu, 23 Nov 2023 09:11:17 -0800 Subject: [PATCH 1/2] Handle invalid vector slice base expressions The elaboration of the base expression of a vector slice index can fail and return a nullptr. Currently this results in a nullptr deref. Handle that case by exiting the function early. Signed-off-by: Lars-Peter Clausen --- elab_expr.cc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/elab_expr.cc b/elab_expr.cc index 0080d9971..9f1074221 100644 --- a/elab_expr.cc +++ b/elab_expr.cc @@ -5994,6 +5994,8 @@ NetExpr* PEIdent::elaborate_expr_net_idx_up_(Design*des, NetScope*scope, return 0; NetExpr*base = calculate_up_do_base_(des, scope, need_const); + if (!base) + return nullptr; // Use the part select width already calculated by test_width(). unsigned long wid = min_width_; @@ -6141,6 +6143,8 @@ NetExpr* PEIdent::elaborate_expr_net_idx_do_(Design*des, NetScope*scope, return 0; NetExpr*base = calculate_up_do_base_(des, scope, need_const); + if (!base) + return nullptr; // Use the part select width already calculated by test_width(). unsigned long wid = min_width_; From 8f006a22b48166d99250b42836375177ffbee875 Mon Sep 17 00:00:00 2001 From: Lars-Peter Clausen Date: Wed, 27 Dec 2023 09:14:26 -0800 Subject: [PATCH 2/2] Add regression tests for invalid part select base expressions Check that a invalid part select base expression results in a compile error. Signed-off-by: Lars-Peter Clausen --- ivtest/ivltests/partsel_invalid_idx1.v | 14 ++++++++++++++ ivtest/ivltests/partsel_invalid_idx2.v | 14 ++++++++++++++ ivtest/ivltests/partsel_invalid_idx3.v | 14 ++++++++++++++ ivtest/ivltests/partsel_invalid_idx4.v | 15 +++++++++++++++ ivtest/ivltests/partsel_invalid_idx5.v | 15 +++++++++++++++ ivtest/ivltests/partsel_invalid_idx6.v | 15 +++++++++++++++ ivtest/regress-vvp.list | 6 ++++++ ivtest/vvp_tests/partsel_invalid_idx1.json | 4 ++++ ivtest/vvp_tests/partsel_invalid_idx2.json | 4 ++++ ivtest/vvp_tests/partsel_invalid_idx3.json | 4 ++++ ivtest/vvp_tests/partsel_invalid_idx4.json | 4 ++++ ivtest/vvp_tests/partsel_invalid_idx5.json | 4 ++++ ivtest/vvp_tests/partsel_invalid_idx6.json | 4 ++++ 13 files changed, 117 insertions(+) create mode 100644 ivtest/ivltests/partsel_invalid_idx1.v create mode 100644 ivtest/ivltests/partsel_invalid_idx2.v create mode 100644 ivtest/ivltests/partsel_invalid_idx3.v create mode 100644 ivtest/ivltests/partsel_invalid_idx4.v create mode 100644 ivtest/ivltests/partsel_invalid_idx5.v create mode 100644 ivtest/ivltests/partsel_invalid_idx6.v create mode 100644 ivtest/vvp_tests/partsel_invalid_idx1.json create mode 100644 ivtest/vvp_tests/partsel_invalid_idx2.json create mode 100644 ivtest/vvp_tests/partsel_invalid_idx3.json create mode 100644 ivtest/vvp_tests/partsel_invalid_idx4.json create mode 100644 ivtest/vvp_tests/partsel_invalid_idx5.json create mode 100644 ivtest/vvp_tests/partsel_invalid_idx6.json diff --git a/ivtest/ivltests/partsel_invalid_idx1.v b/ivtest/ivltests/partsel_invalid_idx1.v new file mode 100644 index 000000000..a6a421982 --- /dev/null +++ b/ivtest/ivltests/partsel_invalid_idx1.v @@ -0,0 +1,14 @@ +// Check that a non-existent index into a vector results in an elaboration error. + +module test; + + reg [31:0] a; + wire b; + + assign b = a[does_not_exist]; // Error: Invalid index + + initial begin + $display("FAILED"); + end + +endmodule diff --git a/ivtest/ivltests/partsel_invalid_idx2.v b/ivtest/ivltests/partsel_invalid_idx2.v new file mode 100644 index 000000000..040507d37 --- /dev/null +++ b/ivtest/ivltests/partsel_invalid_idx2.v @@ -0,0 +1,14 @@ +// Check that a non-existent index into a vector results in an elaboration error. + +module test; + + reg [31:0] a; + wire [1:0] b; + + assign b = a[does_not_exist+:2]; // Error: Invalid base index + + initial begin + $display("FAILED"); + end + +endmodule diff --git a/ivtest/ivltests/partsel_invalid_idx3.v b/ivtest/ivltests/partsel_invalid_idx3.v new file mode 100644 index 000000000..88b96cd64 --- /dev/null +++ b/ivtest/ivltests/partsel_invalid_idx3.v @@ -0,0 +1,14 @@ +// Check that a non-existent index into a vector results in an elaboration error. + +module test; + + reg [31:0] a; + wire [1:0] b; + + assign b = a[does_not_exist-:2]; // Error: Invalid base index + + initial begin + $display("FAILED"); + end + +endmodule diff --git a/ivtest/ivltests/partsel_invalid_idx4.v b/ivtest/ivltests/partsel_invalid_idx4.v new file mode 100644 index 000000000..7c8c602fd --- /dev/null +++ b/ivtest/ivltests/partsel_invalid_idx4.v @@ -0,0 +1,15 @@ +// Check that a non-existent index into a parameter results in an elaboration error. + +module test; + + parameter [31:0] P = 'h0; + + wire x; + + assign x = P[does_not_exist]; // Error: Invalid index + + initial begin + $display("FAILED"); + end + +endmodule diff --git a/ivtest/ivltests/partsel_invalid_idx5.v b/ivtest/ivltests/partsel_invalid_idx5.v new file mode 100644 index 000000000..22ba33e28 --- /dev/null +++ b/ivtest/ivltests/partsel_invalid_idx5.v @@ -0,0 +1,15 @@ +// Check that a non-existent index into a parameter results in an elaboration error. + +module test; + + parameter [31:0] P = 'h0; + + wire [1:0] x; + + assign x = P[does_not_exist+:2]; // Error: Invalid base index + + initial begin + $display("FAILED"); + end + +endmodule diff --git a/ivtest/ivltests/partsel_invalid_idx6.v b/ivtest/ivltests/partsel_invalid_idx6.v new file mode 100644 index 000000000..6fae10381 --- /dev/null +++ b/ivtest/ivltests/partsel_invalid_idx6.v @@ -0,0 +1,15 @@ +// Check that a non-existent index into a parameter results in an elaboration error. + +module test; + + parameter [31:0] P = 'h0; + + wire [1:0] x; + + assign x = P[does_not_exist-:2]; // Error: Invalid base index + + initial begin + $display("FAILED"); + end + +endmodule diff --git a/ivtest/regress-vvp.list b/ivtest/regress-vvp.list index 09091b4e2..32b005cea 100644 --- a/ivtest/regress-vvp.list +++ b/ivtest/regress-vvp.list @@ -86,6 +86,12 @@ module_ordered_list2 vvp_tests/module_ordered_list2.json module_port_array1 vvp_tests/module_port_array1.json module_port_array_init1 vvp_tests/module_port_array_init1.json non-polymorphic-abs vvp_tests/non-polymorphic-abs.json +partsel_invalid_idx1 vvp_tests/partsel_invalid_idx1.json +partsel_invalid_idx2 vvp_tests/partsel_invalid_idx2.json +partsel_invalid_idx3 vvp_tests/partsel_invalid_idx3.json +partsel_invalid_idx4 vvp_tests/partsel_invalid_idx4.json +partsel_invalid_idx5 vvp_tests/partsel_invalid_idx5.json +partsel_invalid_idx6 vvp_tests/partsel_invalid_idx6.json param_test3 vvp_tests/param_test3.json param-width vvp_tests/param-width.json param-width-vlog95 vvp_tests/param-width-vlog95.json diff --git a/ivtest/vvp_tests/partsel_invalid_idx1.json b/ivtest/vvp_tests/partsel_invalid_idx1.json new file mode 100644 index 000000000..df6648396 --- /dev/null +++ b/ivtest/vvp_tests/partsel_invalid_idx1.json @@ -0,0 +1,4 @@ +{ + "type" : "CE", + "source" : "partsel_invalid_idx1.v" +} diff --git a/ivtest/vvp_tests/partsel_invalid_idx2.json b/ivtest/vvp_tests/partsel_invalid_idx2.json new file mode 100644 index 000000000..ef3a7c5cd --- /dev/null +++ b/ivtest/vvp_tests/partsel_invalid_idx2.json @@ -0,0 +1,4 @@ +{ + "type" : "CE", + "source" : "partsel_invalid_idx2.v" +} diff --git a/ivtest/vvp_tests/partsel_invalid_idx3.json b/ivtest/vvp_tests/partsel_invalid_idx3.json new file mode 100644 index 000000000..7df8bafd1 --- /dev/null +++ b/ivtest/vvp_tests/partsel_invalid_idx3.json @@ -0,0 +1,4 @@ +{ + "type" : "CE", + "source" : "partsel_invalid_idx3.v" +} diff --git a/ivtest/vvp_tests/partsel_invalid_idx4.json b/ivtest/vvp_tests/partsel_invalid_idx4.json new file mode 100644 index 000000000..b8db08862 --- /dev/null +++ b/ivtest/vvp_tests/partsel_invalid_idx4.json @@ -0,0 +1,4 @@ +{ + "type" : "CE", + "source" : "partsel_invalid_idx4.v" +} diff --git a/ivtest/vvp_tests/partsel_invalid_idx5.json b/ivtest/vvp_tests/partsel_invalid_idx5.json new file mode 100644 index 000000000..d9212489a --- /dev/null +++ b/ivtest/vvp_tests/partsel_invalid_idx5.json @@ -0,0 +1,4 @@ +{ + "type" : "CE", + "source" : "partsel_invalid_idx5.v" +} diff --git a/ivtest/vvp_tests/partsel_invalid_idx6.json b/ivtest/vvp_tests/partsel_invalid_idx6.json new file mode 100644 index 000000000..3c7b2c5b8 --- /dev/null +++ b/ivtest/vvp_tests/partsel_invalid_idx6.json @@ -0,0 +1,4 @@ +{ + "type" : "CE", + "source" : "partsel_invalid_idx6.v" +}