From: Justin Viiret <justin.viiret@intel.com>
Date: Mon, 14 Dec 2015 23:05:22 +0000 (+1100)
Subject: convertAnchPrefixToBounds: check size of delay_adj
X-Git-Tag: v4.2.0^2~207
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=db4176c13ed030fbc64111950b25e68f9aa07773;p=thirdparty%2Fvectorscan.git

convertAnchPrefixToBounds: check size of delay_adj

Avoid subtracting delay_adj from a smaller max bound.
---

diff --git a/src/rose/rose_build_convert.cpp b/src/rose/rose_build_convert.cpp
index 2ce211bf..f5e99c23 100644
--- a/src/rose/rose_build_convert.cpp
+++ b/src/rose/rose_build_convert.cpp
@@ -1098,6 +1098,11 @@ void convertAnchPrefixToBounds(RoseBuildImpl &tbi) {
         DEBUG_PRINTF("castle has repeat %s\n", pr.bounds.str().c_str());
         DEBUG_PRINTF("delay adj %u\n", (u32)delay_adj);
 
+        if (delay_adj >= pr.bounds.max) {
+            DEBUG_PRINTF("delay adj too large\n");
+            continue;
+        }
+
         DepthMinMax bounds(pr.bounds); // copy
         if (delay_adj > bounds.min) {
             bounds.min = 0;