Int64 bounds-check on array write paths and array methods - #34
Open
Vizit0r wants to merge 1 commit into
Open
Conversation
1dbf8a9 widened the element read paths. The write paths and the array methods still truncated the Int64 index into a 32 bit local before the bounds check, so an out-of-range index silently hit the wrong element: var d : array of Integer; d.SetLength(5); var i : Integer := 4294967296; d[i] := 999; // no error, writes d[0] d.Delete(i); // no error, deletes element 0 - index locals widened to Int64 in TDynamicArraySetExpr, TDynamicArraySetVarExpr, TDynamicArraySetDataExpr, TOpenArrayExpr.GetDataPtr and TArray{Swap,Delete,Copy,Insert,Move}Expr - TBoundsHelper.BoundsCheck: parameters widened, Cardinal -> UInt64 compare - TDynamicArraySetExpr / TDynamicArraySetVarExpr check the bounds before calling SetFromExpr, whose index parameter is NativeInt and therefore truncates on 32 bit targets - TStaticArrayExpr.GetIndex: NativeUInt -> UInt64. With NativeUInt the check is still 32 bit on a 32 bit target, and array_bounds_int64.pas fails when the test project is built for Win32 - Raise{Upper,Lower}Exceeded and BoundsCheckFailed take an Int64 index, so the error message reports the real index instead of its low 32 bits Test\ArrayPass\array_bounds_int64 extended with the dynamic-array write case and with Delete/Insert/Swap/Move/Copy.
Vizit0r
force-pushed
the
int64-bounds-write-paths
branch
from
August 5, 2026 15:12
f43c901 to
2d32c31
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1dbf8a9 widened the element read paths. The write paths and the array methods still truncate the Int64 index into a 32-bit local before the bounds check, so an out-of-range index silently hits the wrong element:
Changes in dwsArrayExprs / dwsExprs:
(1) Index locals widened to Int64 in TDynamicArraySetExpr, TDynamicArraySetVarExpr, TDynamicArraySetDataExpr, TOpenArrayExpr.GetDataPtr and TArray{Swap,Delete,Copy,Insert,Move}Expr.
(2) TBoundsHelper.BoundsCheck: parameters widened, Cardinal changed to UInt64 in the comparison.
(3) TDynamicArraySetExpr and TDynamicArraySetVarExpr check the bounds themselves before calling SetFromExpr, whose index parameter is NativeInt and therefore truncates on 32-bit targets.
(4) TStaticArrayExpr.GetIndex: NativeUInt changed to UInt64. With NativeUInt the comparison is still 32-bit on a 32-bit target, so Test/ArrayPass/array_bounds_int64.pas fails when the test project is built for Win32.
(5) Raise{Upper,Lower}Exceeded and BoundsCheckFailed take an Int64 index, so the message reports the real index instead of its low 32 bits.
Test/ArrayPass/array_bounds_int64 is extended with the dynamic-array write case and with Delete/Insert/Swap/Move/Copy.
Verified by running the script corpus (SimpleScripts, ArrayPass and the other Pass categories, about 1500 compile+execute runs) on both Win32 and Win64: the extended test is red on current master and green with this change, and no other script changes behaviour.