From c62fdf6b85ac13fe1304ea198716730585a433a8 Mon Sep 17 00:00:00 2001 From: Arshdeep Singh Date: Thu, 23 Apr 2026 01:10:08 +0530 Subject: [PATCH] fix(sema): reject subscripting zero-length bytes literal Signed-off-by: Arshdeep Singh --- src/sema/expression/subscript.rs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/sema/expression/subscript.rs b/src/sema/expression/subscript.rs index e32103c78..b251fb559 100644 --- a/src/sema/expression/subscript.rs +++ b/src/sema/expression/subscript.rs @@ -80,6 +80,17 @@ pub(super) fn array_subscript( index = index.cast(&index.loc(), index_ty.deref_any(), true, ns, diagnostics)?; let deref_ty = array_ty.deref_any(); + + // Subscripting a zero-length bytes type is always out of bounds. + // Reject early to avoid a u8 underflow in codegen (array_length - 1). + if let Type::Bytes(0) = deref_ty { + diagnostics.push(Diagnostic::error( + *loc, + "array subscript is out of bounds".to_string(), + )); + return Err(()); + } + match deref_ty { Type::Bytes(_) | Type::Array(..) | Type::DynamicBytes | Type::Slice(_) => { if array_ty.is_contract_storage() {