2 files changed, 6 insertions, 1 deletions
diff --git a/src/wasm/wasm-s-parser.cpp b/src/wasm/wasm-s-parser.cpp
index 7182860ed..edf8ec6f0 100644
--- a/src/wasm/wasm-s-parser.cpp
+++ b/src/wasm/wasm-s-parser.cpp
@@ -694,7 +694,11 @@ void SExpressionWasmBuilder::preParseHeapTypes(Element& module) {
       return builder.getTempRefType(typeIndices[name], Nullable);
     } else if (String::isNumber(name)) {
       // TODO: Support non-nullable types
-      return builder.getTempRefType(atoi(name), Nullable);
+      size_t index = atoi(name);
+      if (index >= numTypes) {
+        throw ParseException("invalid type index", elem.line, elem.col);
+      }
+      return builder.getTempRefType(index, Nullable);
     } else {
       // TODO: Support non-nullable types
       return Type(stringToHeapType(name), Nullable);
diff --git a/src/wasm/wasm-validator.cpp b/src/wasm/wasm-validator.cpp
index 7e9c30c77..1a5894343 100644
--- a/src/wasm/wasm-validator.cpp
+++ b/src/wasm/wasm-validator.cpp
@@ -2491,6 +2491,7 @@ void FunctionValidator::visitArraySet(ArraySet* curr) {
                 element.type,
                 curr,
                 "array.set must have the proper type");
+  shouldBeTrue(element.mutable_, curr, "array.set type must be mutable");
 }
 
 void FunctionValidator::visitArrayLen(ArrayLen* curr) {