Merge pull request #1633 from ethereum/negative-length-arrays

Reject negative length arrays

2 files changed, 5 insertions, 0 deletions

diff --git a/libsolidity/analysis/ReferencesResolver.cpp b/libsolidity/analysis/ReferencesResolver.cpp
index df579c3d..d589f4a0 100644
--- a/libsolidity/analysis/ReferencesResolver.cpp
+++ b/libsolidity/analysis/ReferencesResolver.cpp
@@ -130,6 +130,8 @@ void ReferencesResolver::endVisit(ArrayTypeName const& _typeName)
 		auto const* lengthType = dynamic_cast<RationalNumberType const*>(length->annotation().type.get());
 		if (!lengthType || lengthType->isFractional())
 			fatalTypeError(length->location(), "Invalid array length, expected integer literal.");
+		else if (lengthType->isNegative())
+			fatalTypeError(length->location(), "Array with negative length specified.");
 		else
 			_typeName.annotation().type = make_shared<ArrayType>(DataLocation::Storage, baseType, lengthType->literalValue(nullptr));
 	}
diff --git a/libsolidity/ast/Types.h b/libsolidity/ast/Types.h
index 3917dca2..e280b32c 100644
--- a/libsolidity/ast/Types.h
+++ b/libsolidity/ast/Types.h
@@ -411,6 +411,9 @@ public:
 	/// @returns true if the value is not an integer.
 	bool isFractional() const { return m_value.denominator() != 1; }
 
+	/// @returns true if the value is negative.
+	bool isNegative() const { return m_value < 0; }
+
 private:
 	rational m_value;
 };