From 33250eef9e3322a366a71fbd55df12e829d70726 Mon Sep 17 00:00:00 2001
From: Alex Beregszaszi <alex@rtfs.hu>
Date: Tue, 7 Jun 2016 19:36:42 +0100
Subject: [PATCH] Reject negative shifts within constants

---
 libsolidity/ast/Types.cpp | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/libsolidity/ast/Types.cpp b/libsolidity/ast/Types.cpp
index a6c73953c..3f13d62da 100644
--- a/libsolidity/ast/Types.cpp
+++ b/libsolidity/ast/Types.cpp
@@ -710,9 +710,11 @@ TypePointer RationalNumberType::binaryOperatorResult(Token::Value _operator, Typ
 			using boost::multiprecision::pow;
 			if (fractional)
 				return TypePointer();
-			else if (abs(other.m_value) > numeric_limits<uint32_t>::max())
+			else if (other.m_value < 0)
 				return TypePointer();
-			uint32_t exponent = abs(other.m_value).numerator().convert_to<uint32_t>();
+			else if (other.m_value > numeric_limits<uint32_t>::max())
+				return TypePointer();
+			uint32_t exponent = other.m_value.numerator().convert_to<uint32_t>();
 			value = m_value.numerator() * pow(bigint(2), exponent);
 			break;
 		}
@@ -721,9 +723,11 @@ TypePointer RationalNumberType::binaryOperatorResult(Token::Value _operator, Typ
 			using boost::multiprecision::pow;
 			if (fractional)
 				return TypePointer();
-			else if (abs(other.m_value) > numeric_limits<uint32_t>::max())
+			else if (other.m_value < 0)
 				return TypePointer();
-			uint32_t exponent = abs(other.m_value).numerator().convert_to<uint32_t>();
+			else if (other.m_value > numeric_limits<uint32_t>::max())
+				return TypePointer();
+			uint32_t exponent = other.m_value.numerator().convert_to<uint32_t>();
 			value = rational(m_value.numerator() / pow(bigint(2), exponent), 1);
 			break;
 		}