From 697db80b48fbed596996a2dab20948f42fdb1dfb Mon Sep 17 00:00:00 2001
From: Alex Beregszaszi <alex@rtfs.hu>
Date: Thu, 2 Feb 2017 00:24:45 +0000
Subject: Disallow arrays with negative length

---
 Changelog.md                                       |  3 +++
 libsolidity/analysis/ReferencesResolver.cpp        |  2 ++
 test/libsolidity/SolidityNameAndTypeResolution.cpp | 10 ++++++++++
 3 files changed, 15 insertions(+)

diff --git a/Changelog.md b/Changelog.md
index c1098bdf..79d2fe44 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -3,6 +3,9 @@
 Features:
  * Type system: Support explicit conversion of external function to address.
 
+Bugfixes:
+ * Type system: Disallow arrays with negative length.
+
 ### 0.4.9 (2017-01-31)
 
 Features:
diff --git a/libsolidity/analysis/ReferencesResolver.cpp b/libsolidity/analysis/ReferencesResolver.cpp
index df579c3d..d589f4a0 100644
--- a/libsolidity/analysis/ReferencesResolver.cpp
+++ b/libsolidity/analysis/ReferencesResolver.cpp
@@ -130,6 +130,8 @@ void ReferencesResolver::endVisit(ArrayTypeName const& _typeName)
 		auto const* lengthType = dynamic_cast<RationalNumberType const*>(length->annotation().type.get());
 		if (!lengthType || lengthType->isFractional())
 			fatalTypeError(length->location(), "Invalid array length, expected integer literal.");
+		else if (lengthType->isNegative())
+			fatalTypeError(length->location(), "Array with negative length specified.");
 		else
 			_typeName.annotation().type = make_shared<ArrayType>(DataLocation::Storage, baseType, lengthType->literalValue(nullptr));
 	}
diff --git a/test/libsolidity/SolidityNameAndTypeResolution.cpp b/test/libsolidity/SolidityNameAndTypeResolution.cpp
index f5768022..0151d244 100644
--- a/test/libsolidity/SolidityNameAndTypeResolution.cpp
+++ b/test/libsolidity/SolidityNameAndTypeResolution.cpp
@@ -1919,6 +1919,16 @@ BOOST_AUTO_TEST_CASE(array_with_nonconstant_length)
 	CHECK_ERROR(text, TypeError, "");
 }
 
+BOOST_AUTO_TEST_CASE(array_with_negative_length)
+{
+	char const* text = R"(
+		contract c {
+			function f(uint a) { uint8[-1] x; }
+		}
+	)";
+	CHECK_ERROR(text, TypeError, "Array with negative length specified");
+}
+
 BOOST_AUTO_TEST_CASE(array_copy_with_different_types1)
 {
 	char const* text = R"(
-- 
cgit