Merge pull request #1633 from ethereum/negative-length-arrays

Reject negative length arrays

4 files changed, 18 insertions, 0 deletions

diff --git a/Changelog.md b/Changelog.md
index c1098bdf..79d2fe44 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -3,6 +3,9 @@
 Features:
  * Type system: Support explicit conversion of external function to address.
 
+Bugfixes:
+ * Type system: Disallow arrays with negative length.
+
 ### 0.4.9 (2017-01-31)
 
 Features:
diff --git a/libsolidity/analysis/ReferencesResolver.cpp b/libsolidity/analysis/ReferencesResolver.cpp
index df579c3d..d589f4a0 100644
--- a/libsolidity/analysis/ReferencesResolver.cpp
+++ b/libsolidity/analysis/ReferencesResolver.cpp
@@ -130,6 +130,8 @@ void ReferencesResolver::endVisit(ArrayTypeName const& _typeName)
 		auto const* lengthType = dynamic_cast<RationalNumberType const*>(length->annotation().type.get());
 		if (!lengthType || lengthType->isFractional())
 			fatalTypeError(length->location(), "Invalid array length, expected integer literal.");
+		else if (lengthType->isNegative())
+			fatalTypeError(length->location(), "Array with negative length specified.");
 		else
 			_typeName.annotation().type = make_shared<ArrayType>(DataLocation::Storage, baseType, lengthType->literalValue(nullptr));
 	}
diff --git a/libsolidity/ast/Types.h b/libsolidity/ast/Types.h
index 3917dca2..e280b32c 100644
--- a/libsolidity/ast/Types.h
+++ b/libsolidity/ast/Types.h
@@ -411,6 +411,9 @@ public:
 	/// @returns true if the value is not an integer.
 	bool isFractional() const { return m_value.denominator() != 1; }
 
+	/// @returns true if the value is negative.
+	bool isNegative() const { return m_value < 0; }
+
 private:
 	rational m_value;
 };
diff --git a/test/libsolidity/SolidityNameAndTypeResolution.cpp b/test/libsolidity/SolidityNameAndTypeResolution.cpp
index f5768022..0151d244 100644
--- a/test/libsolidity/SolidityNameAndTypeResolution.cpp
+++ b/test/libsolidity/SolidityNameAndTypeResolution.cpp
@@ -1919,6 +1919,16 @@ BOOST_AUTO_TEST_CASE(array_with_nonconstant_length)
 	CHECK_ERROR(text, TypeError, "");
 }
 
+BOOST_AUTO_TEST_CASE(array_with_negative_length)
+{
+	char const* text = R"(
+		contract c {
+			function f(uint a) { uint8[-1] x; }
+		}
+	)";
+	CHECK_ERROR(text, TypeError, "Array with negative length specified");
+}
+
 BOOST_AUTO_TEST_CASE(array_copy_with_different_types1)
 {
 	char const* text = R"(