Missing bounds check on upper bound with const ranges foo[1:3].

releasenotes.md

@@ -15,6 +15,7 @@
 - Correctly reject interface methods `type` and `ptr`.
 - Comparing a null ZString with a non-null ZString would crash.
 - Switch case with const non-int / enum would be treated as ints and crash. #2263
+- Missing bounds check on upper bound with const ranges `foo[1:3]`.
 
 ### Stdlib changes
 

src/compiler/sema_expr.c

@@ -4106,9 +4106,9 @@ INLINE bool sema_expr_analyse_range_internal(SemaContext *context, Range *range,
 				}
 				break;
 			case RANGE_CONST_RANGE:
-				if (range->len_index > len)
+				if (range->start_index + range->len_index > len)
 				{
-					RETURN_SEMA_ERROR(end ? end : start, "End index out of bounds, was %d, exceeding max index %d.", range->len_index - 1, len - 1);
+					RETURN_SEMA_ERROR(end ? end : start, "End index out of bounds, was %d, exceeding max index %d.", range->start_index + range->len_index - 1, len - 1);
 				}
 				break;
 			default:

test/test_suite/slices/out_of_range.c3

@@ -0,0 +1,8 @@
+module ccc;
+
+fn int main()
+{
+	int[3] abc = {1, 2, 3};
+	abc[1:3]; // #error: End index out of bounds, was 3, exceeding max index 2.
+	return 0;
+}