String & String views: Add bounds checking to range subscripts.

Author: lorentey

stdlib/public/core/StringRangeReplaceableCollection.swift.gyb

@@ -89,6 +89,34 @@ extension String : StringProtocol, RangeReplaceableCollection {
   @_inlineable // FIXME(sil-serialize-all)
   public var endIndex: Index { return Index(encodedOffset: _guts.count) }
 
+  @_inlineable
+  @_versioned
+  @inline(__always)
+  internal func _boundsCheck(_ index: Index) {
+    _precondition(index.encodedOffset >= 0 && index.encodedOffset < _guts.count,
+      "String index is out of bounds")
+  }
+
+  @_inlineable
+  @_versioned
+  @inline(__always)
+  internal func _boundsCheck(_ range: Range<Index>) {
+    _precondition(
+      range.lowerBound.encodedOffset >= 0 &&
+      range.upperBound.encodedOffset <= _guts.count,
+      "String index range is out of bounds")
+  }
+
+  @_inlineable
+  @_versioned
+  @inline(__always)
+  internal func _boundsCheck(_ range: ClosedRange<Index>) {
+    _precondition(
+      range.lowerBound.encodedOffset >= 0 &&
+      range.upperBound.encodedOffset < _guts.count,
+      "String index range is out of bounds")
+  }
+
   @_inlineable // FIXME(sil-serialize-all)
   @_versioned // FIXME(sil-serialize-all)
   internal func _index(atEncodedOffset offset: Int) -> Index {

stdlib/public/core/StringStorage.swift

@@ -12,6 +12,7 @@
 
 import SwiftShims
 
+@_fixed_layout
 public
 class _SwiftRawStringStorage : _SwiftNativeNSString {
   @nonobjc
@@ -46,6 +47,7 @@ class _SwiftRawStringStorage : _SwiftNativeNSString {
 internal typealias _ASCIIStringStorage = _SwiftStringStorage<UInt8>
 internal typealias _UTF16StringStorage = _SwiftStringStorage<UTF16.CodeUnit>
 
+@_fixed_layout
 public final class _SwiftStringStorage<CodeUnit>
   : _SwiftRawStringStorage, _NSStringCore
 where CodeUnit : UnsignedInteger & FixedWidthInteger {

stdlib/public/core/Substring.swift.gyb

@@ -433,6 +433,9 @@ extension Substring.${View} : BidirectionalCollection {
   }
   @_inlineable // FIXME(sil-serialize-all)
   public subscript(r: Range<Index>) -> SubSequence {
+    // FIXME(strings): tests.
+    _precondition(r.lowerBound >= startIndex && r.upperBound <= endIndex,
+      "${View} index range out of bounds")
     return Substring.${View}(_wholeString.${property}, _bounds: r)
   }
 }
@@ -607,19 +610,22 @@ extension String {
   @_inlineable // FIXME(sil-serialize-all)
   @available(swift, introduced: 4)
   public subscript(r: Range<Index>) -> Substring {
+    _boundsCheck(r)
     return Substring(
       _slice: Slice(base: self, bounds: r))
   }
 
   @_inlineable // FIXME(sil-serialize-all)
   @available(swift, obsoleted: 4)
   public subscript(bounds: Range<Index>) -> String {
+    _boundsCheck(bounds)
     return String(Substring(_slice: Slice(base: self, bounds: bounds)))
   }
 
   @_inlineable // FIXME(sil-serialize-all)
   @available(swift, obsoleted: 4)
   public subscript(bounds: ClosedRange<Index>) -> String {
+    _boundsCheck(bounds)
     return String(Substring(_slice: Slice(
           base: self,
           bounds: bounds.relative(to: self))))

validation-test/stdlib/String.swift

@@ -301,6 +301,28 @@ StringTests.test("ForeignIndexes/subscript(Range)/OutOfBoundsTrap/2") {
   _ = acceptor[r]
 }
 
+StringTests.test("ForeignIndexes/subscript(ClosedRange)/OutOfBoundsTrap/1") {
+  let donor = "abcdef"
+  let acceptor = "uvw"
+
+  expectEqual("uvw", acceptor[donor.startIndex...donor.index(_nth: 2)])
+
+  let r = donor.startIndex...donor.index(_nth: 3)
+  expectCrashLater()
+  _ = acceptor[r]
+}
+
+StringTests.test("ForeignIndexes/subscript(ClosedRange)/OutOfBoundsTrap/2") {
+  let donor = "abcdef"
+  let acceptor = "uvw"
+
+  expectEqual("uvw", acceptor[donor.startIndex...donor.index(_nth: 2)])
+
+  let r = donor.index(_nth: 3)...donor.index(_nth: 5)
+  expectCrashLater()
+  _ = acceptor[r]
+}
+
 StringTests.test("ForeignIndexes/replaceSubrange/OutOfBoundsTrap/1") {
   let donor = "abcdef"
   var acceptor = "uvw"