Fix #4716: Crash when array index value is too large

This commit is contained in:
bakaoh 2018-08-30 10:08:49 +07:00
parent 410d288dfc
commit a7ffff6a29
3 changed files with 14 additions and 4 deletions

View File

@ -111,6 +111,7 @@ Bugfixes:
* Type Checker: Report error when using structs in events without experimental ABIEncoderV2. This used to crash or log the wrong values.
* Type Checker: Report error when using indexed structs in events with experimental ABIEncoderV2. This used to log wrong values.
* Type Checker: Dynamic types as key for public mappings return error instead of assertion fail.
* Type Checker: Fix internal error when array index value is too large.
* Type System: Allow arbitrary exponents for literals with a mantissa of zero.
### 0.4.24 (2018-05-16)

View File

@ -2211,12 +2211,13 @@ bool TypeChecker::visit(IndexAccess const& _access)
else
{
expectType(*index, IntegerType(256));
if (auto numberType = dynamic_cast<RationalNumberType const*>(type(*index).get()))
{
if (!numberType->isFractional()) // error is reported above
if (!m_errorReporter.hasErrors())
if (auto numberType = dynamic_cast<RationalNumberType const*>(type(*index).get()))
{
solAssert(!numberType->isFractional(), "");
if (!actualType.isDynamicallySized() && actualType.length() <= numberType->literalValue(nullptr))
m_errorReporter.typeError(_access.location(), "Out of bounds array access.");
}
}
}
resultType = actualType.baseType();
isLValue = actualType.location() != DataLocation::CallData;

View File

@ -0,0 +1,8 @@
contract C {
function f() public returns (string memory) {
// this used to cause an internal error
return (["zeppelin"][123456789012345678901234567890123456789012345678901234567890123456789012345678]);
}
}
// ----
// TypeError: (140-218): Type int_const 1234...(70 digits omitted)...5678 is not implicitly convertible to expected type uint256.