From 3732ce7c635894329acf95bb55a981d671664f23 Mon Sep 17 00:00:00 2001 From: Sven Verdoolaege Date: Fri, 27 Jul 2012 17:17:38 +0200 Subject: [PATCH] isl_map_eliminate: check for overflow in computation of last dimension In particular, if the computation of the last dimension overflows, then at least one of the dimensions is out of bounds. Signed-off-by: Sven Verdoolaege --- isl_map.c | 4 ++++ isl_map_simplify.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/isl_map.c b/isl_map.c index a8f3a557..26eb7d26 100644 --- a/isl_map.c +++ b/isl_map.c @@ -1607,6 +1607,10 @@ __isl_give isl_map *isl_map_eliminate(__isl_take isl_map *map, if (n == 0) return map; + if (first + n > isl_map_dim(map, type) || first + n < first) + isl_die(map->ctx, isl_error_invalid, + "index out of bounds", goto error); + map = isl_map_cow(map); if (!map) return NULL; diff --git a/isl_map_simplify.c b/isl_map_simplify.c index ef9e90d3..d550698c 100644 --- a/isl_map_simplify.c +++ b/isl_map_simplify.c @@ -1391,7 +1391,7 @@ __isl_give isl_basic_map *isl_basic_map_eliminate( if (n == 0) return bmap; - if (first + n > isl_basic_map_dim(bmap, type)) + if (first + n > isl_basic_map_dim(bmap, type) || first + n < first) isl_die(bmap->ctx, isl_error_invalid, "index out of bounds", goto error); -- 2.11.4.GIT