isl_map_eliminate: check for overflow in computation of last dimension

In particular, if the computation of the last dimension overflows,
then at least one of the dimensions is out of bounds.

Signed-off-by: Sven Verdoolaege <skimo@kotnet.org>

diff --git a/isl_map.c b/isl_map.c
index a8f3a55..26eb7d2 100644 (file)
--- a/isl_map.c
+++ b/isl_map.c
@@ -1607,6 +1607,10 @@ __isl_give isl_map *isl_map_eliminate(__isl_take isl_map *map,
        if (n == 0)
                return map;
 
+       if (first + n > isl_map_dim(map, type) || first + n < first)
+               isl_die(map->ctx, isl_error_invalid,
+                       "index out of bounds", goto error);
+
        map = isl_map_cow(map);
        if (!map)
                return NULL;

diff --git a/isl_map_simplify.c b/isl_map_simplify.c
index ef9e90d..d550698 100644 (file)
--- a/isl_map_simplify.c
+++ b/isl_map_simplify.c
@@ -1391,7 +1391,7 @@ __isl_give isl_basic_map *isl_basic_map_eliminate(
        if (n == 0)
                return bmap;
 
-       if (first + n > isl_basic_map_dim(bmap, type))
+       if (first + n > isl_basic_map_dim(bmap, type) || first + n < first)
                isl_die(bmap->ctx, isl_error_invalid,
                        "index out of bounds", goto error);