Solidity: Crash when array index value is too large

[mattaereal]

_This issue is being reported as part of the current audit being held by Zeppelin Solutions to Solidity's compiler (tag v0.4.24)._

Description

Compiler crashes when a rational type over 78 digits is present as an array index.

Error in file

Integer constant too large.
libsolidity/ast/Types.cpp(1144)

Displayed message

Throw in function virtual dev::u256 dev::solidity::RationalNumberType::literalValue(const dev::solidity::Literal*) const

Example code

pragma solidity ^0.4.24;
contract CrashContract {
    function f() returns (string) {
        return (["zeppelin"][123456789012345678901234567890123456789012345678901234567890123456789012345678]);
    }
}

[axic]

No longer a problem in develop (0.5.0):

4716.sol:3:30: Error: Expected primary expression.
        return (["zeppelin"][0000000001000000000200000000030000000004000000000500000000060000000007000000000]);
                             ^

[axic]

Hm, also with 0.4.24+commit.e67f0147.Emscripten.clang in Remix I get the same result.

[mattaereal]

Let me check again. Something must've happened when I minimized the test code.

[mattaereal]

Updated with working example. I was missing digits it seems.

[axic]

Yes, the updated example still produces the same problem on develop.

[chriseth]

The two functions RationalNumberType::literalValue and RationalNumberType::integerType() should work in tandem - intergerType() (called from mobileType()) is called first, and if it returns a null pointer, literalValue() should not be called, but somehow it is.

[randomnetcat]

On develop, TypeChecker.cpp line 2098

[gitcoinbot]

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

---

__This issue now has a funding of 345.0 DAI (345.0 USD @ $1.0/DAI) attached to it.__

• If you would like to work on this issue you can 'start work' on the Gitcoin Issue Details page.
  
  
  
  • Want to chip in? Add your own contribution here.
  
  
  • Questions? Checkout Gitcoin Help or the Gitcoin Slack
  
  
  • $25,975.74 more funded OSS Work available on the Gitcoin Issue Explorer
  
  

[mridulnagpal]

@chriseth I am new to solidity, can you tell me the steps to resolve this issue?

[chriseth]

You could start by checking how literalValue() is called even though mobileType() returned a null pointer when called on the same object before (please also check if that is the case).

[gitcoinbot]

@mridulnagpal Hello from Gitcoin Core - are you still working on this issue? Please submit a WIP PR or comment back within the next 3 days or you will be removed from this ticket and it will be returned to an ‘Open’ status. Please let us know if you have questions!

• [x] warning (3 days)
• [ ] escalation to mods (6 days)

Funders only: Snooze warnings for 1 day | 3 days | 5 days | 10 days | 100 days

[gitcoinbot]

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

---

@mridulnagpal due to inactivity, we have escalated this issue to Gitcoin's moderation team. Let us know if you believe this has been done in error!

• [x] warning (3 days)
• [x] escalation to mods (6 days)

Funders only: Snooze warnings for 1 day | 3 days | 5 days | 10 days | 100 days

[frankchen07]

hey @mridulnagpal - checking in. How's this issue coming along? Do you have a PR link up?

[gitcoinbot]

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

---

__Work has been started__.

These users each claimed they can complete the work by 5 months from now.
Please review their action plans below:

1) bakaoh has been approved to start work.

I guess problem come from this line https://github.com/ethereum/solidity/blob/develop/libsolidity/analysis/TypeChecker.cpp#L2213
expectType function report error Error: Type int_const 1234...(70 digits omitted)...5678 is not implicitly convertible to expected type uint256. but till call numberType->literalValue(nullptr) make it crash.
May i change m_errorReporter.typeError to m_errorReporter.fatalTypeError in expectType to return error instead of assertion fail?

Learn more on the Gitcoin Issue Details page.

[bakaoh]

I guess problem come from this line https://github.com/ethereum/solidity/blob/develop/libsolidity/analysis/TypeChecker.cpp#L2213
expectType function report error Error: Type int_const 1234...(70 digits omitted)...5678 is not implicitly convertible to expected type uint256. but till call numberType->literalValue(nullptr) make it crash.
May i change m_errorReporter.typeError to m_errorReporter.fatalTypeError in expectType to return error instead of assertion fail?

Or should i change expectType to return boolean and check it at line https://github.com/ethereum/solidity/blob/develop/libsolidity/analysis/TypeChecker.cpp#L2214?

[bakaoh]

@lazaridiscom -- thanks a lot, i was not aware of m_errorReporter.hasErrors() method

[gitcoinbot]

@bakaoh Hello from Gitcoin Core - are you still working on this issue? Please submit a WIP PR or comment back within the next 3 days or you will be removed from this ticket and it will be returned to an ‘Open’ status. Please let us know if you have questions!

• [x] warning (3 days)
• [ ] escalation to mods (6 days)

Funders only: Snooze warnings for 1 day | 3 days | 5 days | 10 days | 100 days

[gitcoinbot]

@bakaoh Hello from Gitcoin Core - are you still working on this issue? Please submit a WIP PR or comment back within the next 3 days or you will be removed from this ticket and it will be returned to an ‘Open’ status. Please let us know if you have questions!

• [x] warning (3 days)
• [ ] escalation to mods (6 days)

Funders only: Snooze warnings for 1 day | 3 days | 5 days | 10 days | 100 days

[bakaoh]

@gitcoinbot - i'm waiting for reviewing

[gitcoinbot]

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

---

__Work for 345.0 DAI (345.0 USD @ $1.0/DAI) has been submitted by__:

1. @bakaoh

@vs77bb please take a look at the submitted work:

• PR by @bakaoh

---

• Learn more on the Gitcoin Issue Details page
• Want to chip in? Add your own contribution here.
• Questions? Checkout Gitcoin Help or the Gitcoin Slack
• $22,126.35 more funded OSS Work available on the Gitcoin Issue Explorer

[gitcoinbot]

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

---

__The funding of 345.0 DAI (345.0 USD @ $1.0/DAI) attached to this issue has been approved & issued to @bakaoh.__

• Learn more on the Gitcoin Issue Details page
  
  
  
  • Questions? Checkout Gitcoin Help or the Gitcoin Slack
  
  
  • $18,549.10 more funded OSS Work available on the Gitcoin Issue Explorer