Disallow array slicing for arrays with dyanmically encoded base types.

docs/bugs.json

@@ -1,4 +1,15 @@
 [
+    {
+        "name": "ArraySliceDynamicallyEncodedBaseType",
+        "summary": "Accessing array slices of arrays with dynamically encoded base types (e.g. multi-dimensional arrays) can result in invalid data being read.",
+        "description": "For arrays with dynamically sized base types, index range accesses that use a start expression that is non-zero will result in invalid array slices. Any index access to such array slices will result in data being read from incorrect calldata offsets. Array slices are only supported for dynamic calldata types and all problematic type require ABIEncoderV2 to be enabled.",
+        "introduced": "0.6.0",
+        "fixed": "0.6.8",
+        "severity": "very low",
+        "conditions": {
+            "ABIEncoderV2": true
+        }
+    },
     {
         "name": "ImplicitConstructorCallvalueCheck",
         "summary": "The creation code of a contract that does not define a constructor but has a base that does define a constructor did not revert for calls with non-zero value.",

docs/bugs_by_version.json

@@ -1082,6 +1082,7 @@
     },
     "0.6.0": {
         "bugs": [
+            "ArraySliceDynamicallyEncodedBaseType",
             "ImplicitConstructorCallvalueCheck",
             "TupleAssignmentMultiStackSlotComponents",
             "MemoryArrayCreationOverflow",
@@ -1091,6 +1092,7 @@
     },
     "0.6.1": {
         "bugs": [
+            "ArraySliceDynamicallyEncodedBaseType",
             "ImplicitConstructorCallvalueCheck",
             "TupleAssignmentMultiStackSlotComponents",
             "MemoryArrayCreationOverflow"
@@ -1099,6 +1101,7 @@
     },
     "0.6.2": {
         "bugs": [
+            "ArraySliceDynamicallyEncodedBaseType",
             "ImplicitConstructorCallvalueCheck",
             "TupleAssignmentMultiStackSlotComponents",
             "MemoryArrayCreationOverflow"
@@ -1107,6 +1110,7 @@
     },
     "0.6.3": {
         "bugs": [
+            "ArraySliceDynamicallyEncodedBaseType",
             "ImplicitConstructorCallvalueCheck",
             "TupleAssignmentMultiStackSlotComponents",
             "MemoryArrayCreationOverflow"
@@ -1115,6 +1119,7 @@
     },
     "0.6.4": {
         "bugs": [
+            "ArraySliceDynamicallyEncodedBaseType",
             "ImplicitConstructorCallvalueCheck",
             "TupleAssignmentMultiStackSlotComponents",
             "MemoryArrayCreationOverflow"
@@ -1123,6 +1128,7 @@
     },
     "0.6.5": {
         "bugs": [
+            "ArraySliceDynamicallyEncodedBaseType",
             "ImplicitConstructorCallvalueCheck",
             "TupleAssignmentMultiStackSlotComponents"
         ],
@@ -1130,12 +1136,14 @@
     },
     "0.6.6": {
         "bugs": [
+            "ArraySliceDynamicallyEncodedBaseType",
             "ImplicitConstructorCallvalueCheck"
         ],
         "released": "2020-04-09"
     },
     "0.6.7": {
         "bugs": [
+            "ArraySliceDynamicallyEncodedBaseType",
             "ImplicitConstructorCallvalueCheck"
         ],
         "released": "2020-05-04"