cerc-io/solidity
16
0
Fork 0
mirror of https://github.com/ethereum/solidity synced 2023-10-03 13:03:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #4872 from bakaoh/issue4716

Browse Source 
Crash when array index value is too large
This commit is contained in:
chriseth 2018-09-05 21:47:42 +02:00 committed by GitHub
commit 522174890f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Changelog.md
View File

@ -114,6 +114,7 @@ Bugfixes:
* Type Checker: Report error when using structs in events without experimental ABIEncoderV2. This used to crash or log the wrong values. * Type Checker: Report error when using structs in events without experimental ABIEncoderV2. This used to crash or log the wrong values.
* Type Checker: Report error when using indexed structs in events with experimental ABIEncoderV2. This used to log wrong values. * Type Checker: Report error when using indexed structs in events with experimental ABIEncoderV2. This used to log wrong values.
* Type Checker: Dynamic types as key for public mappings return error instead of assertion fail. * Type Checker: Dynamic types as key for public mappings return error instead of assertion fail.
* Type Checker: Fix internal error when array index value is too large.
* Type System: Allow arbitrary exponents for literals with a mantissa of zero. * Type System: Allow arbitrary exponents for literals with a mantissa of zero.
* Parser: Fix incorrect source location for nameless parameters. * Parser: Fix incorrect source location for nameless parameters.

9
libsolidity/analysis/TypeChecker.cpp
View File

@ -2209,12 +2209,13 @@ bool TypeChecker::visit(IndexAccess const& _access)
else else
{ {
expectType(*index, IntegerType(256)); expectType(*index, IntegerType(256));
if (auto numberType = dynamic_cast<RationalNumberType const*>(type(*index).get())) if (!m_errorReporter.hasErrors())
{ if (auto numberType = dynamic_cast<RationalNumberType const*>(type(*index).get()))
if (!numberType->isFractional()) // error is reported above {
solAssert(!numberType->isFractional(), "");
if (!actualType.isDynamicallySized() && actualType.length() <= numberType->literalValue(nullptr)) if (!actualType.isDynamicallySized() && actualType.length() <= numberType->literalValue(nullptr))
m_errorReporter.typeError(_access.location(), "Out of bounds array access."); m_errorReporter.typeError(_access.location(), "Out of bounds array access.");
} }
} }
resultType = actualType.baseType(); resultType = actualType.baseType();
isLValue = actualType.location() != DataLocation::CallData; isLValue = actualType.location() != DataLocation::CallData;

8
test/libsolidity/syntaxTests/types/array_index_too_large.sol Normal file
View File

@ -0,0 +1,8 @@
contract C {
function f() public returns (string memory) {
// this used to cause an internal error
return (["zeppelin"][123456789012345678901234567890123456789012345678901234567890123456789012345678]);
}
}
// ----
// TypeError: (140-218): Type int_const 1234...(70 digits omitted)...5678 is not implicitly convertible to expected type uint256.