Add bounds check for slice operations

Author: antonmedv

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## v1.4.1
+* Added bounds check for slice operations `foo[0:5]`
+
 ## v1.4.0
 * Added option to allow using undefined variables.
 * Fixed getting default values out of maps.

expr_test.go

@@ -769,10 +769,26 @@ func TestExpr(t *testing.T) {
 			`Variadic("empty")`,
 			[]int{},
 		},
+		{
+			`String[:]`,
+			"string",
+		},
 		{
 			`String[:3]`,
 			"str",
 		},
+		{
+			`String[:9]`,
+			"string",
+		},
+		{
+			`String[3:9]`,
+			"ing",
+		},
+		{
+			`String[7:9]`,
+			"",
+		},
 	}
 
 	for _, tt := range tests {

vm/runtime.go

@@ -57,10 +57,20 @@ func fetch(from interface{}, i interface{}) interface{} {
 
 func slice(array, from, to interface{}) interface{} {
 	v := reflect.ValueOf(array)
-	switch v.Kind() {
 
+	switch v.Kind() {
 	case reflect.Array, reflect.Slice, reflect.String:
-		value := v.Slice(toInt(from), toInt(to))
+		length := v.Len()
+		a, b := toInt(from), toInt(to)
+
+		if b > length {
+			b = length
+		}
+		if a > b {
+			a = b
+		}
+
+		value := v.Slice(a, b)
 		if value.IsValid() && value.CanInterface() {
 			return value.Interface()
 		}