Fix for invalid swizzle causing crash (#4690)

* Fix for invalid swizzle causing crash

Fixes #4689

If swizzle code is provided 5+ element swizzle the checkSwizzleExpr code will do an out of bounds array access and crash.

* switch test to check for to ensure no crash

* cleanup swizzle errors to only emit once

---------

Co-authored-by: Yong He <yonghe@outlook.com>

1 files changed, 11 insertions, 4 deletions

diff --git a/source/slang/slang-check-expr.cpp b/source/slang/slang-check-expr.cpp
index f60ead1e9..fd03e5e87 100644
--- a/source/slang/slang-check-expr.cpp
+++ b/source/slang/slang-check-expr.cpp
@@ -3743,9 +3743,8 @@ namespace Slang
             case 'w': case 'a': elementIndex = 3; break;
             default:
                 // An invalid character in the swizzle is an error
-                getSink()->diagnose(swizExpr, Diagnostics::invalidSwizzleExpr, swizzleText, baseElementType->toString());
                 anyError = true;
-                continue;
+                break;
             }
 
             // TODO(tfoley): GLSL requires that all component names
@@ -3754,9 +3753,16 @@ namespace Slang
             // Make sure the index is in range for the source type
             if (elementIndex >= limitElement)
             {
-                getSink()->diagnose(swizExpr, Diagnostics::invalidSwizzleExpr, swizzleText, baseElementType->toString());
                 anyError = true;
-                continue;
+                break;
+            }
+
+            // If elementCount is already at 4 stop trying to assign a swizzle element and send an error,
+            // we cannot have more valid swizzle elements than 4.
+            if (elementCount >= 4)
+            {
+                anyError = true;
+                break;
             }
 
             // Check if we've seen this index before
@@ -3778,6 +3784,7 @@ namespace Slang
 
         if (anyError)
         {
+            getSink()->diagnose(swizExpr, Diagnostics::invalidSwizzleExpr, swizzleText, baseElementType->toString());
             return CreateErrorExpr(memberRefExpr);
         }
         else if (elementCount == 1)