[PATCH] D60055: Check i < FD->getNumParams() before querying

[Violet via Phabricator via cfe-commits]

Violet created this revision.
Herald added a project: clang.
Herald added a subscriber: cfe-commits.

As was already stated in a previous comment, the parameter isn't
necessarily referring to one of the DeclContext's parameter. We
should check the index is within the range to avoid out-of-boundary
access.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D60055

Files:
  clang/lib/Sema/SemaTemplateInstantiate.cpp
  clang/test/SemaCXX/PR38077.cpp


Index: clang/test/SemaCXX/PR38077.cpp
===================================================================
--- /dev/null
+++ clang/test/SemaCXX/PR38077.cpp
@@ -0,0 +1,14 @@
+// RUN: %clang_cc1 -fsyntax-only -std=c++17 -verify %s
+
+// expected-no-diagnostics
+
+int f1( unsigned ) { return 0; }
+
+template <class R, class... Args>
+struct S1 {
+    S1( R(*f)(Args...) ) {}
+};
+
+int main() {
+    S1 s1( f1 );
+}
Index: clang/lib/Sema/SemaTemplateInstantiate.cpp
===================================================================
--- clang/lib/Sema/SemaTemplateInstantiate.cpp
+++ clang/lib/Sema/SemaTemplateInstantiate.cpp
@@ -2892,7 +2892,7 @@
       unsigned i = PV->getFunctionScopeIndex();
       // This parameter might be from a freestanding function type within the
       // function and isn't necessarily referring to one of FD's parameters.
-      if (FD->getParamDecl(i) == PV)
+      if (i < FD->getNumParams() && FD->getParamDecl(i) == PV)
         return FD->getCanonicalDecl()->getParamDecl(i);
     }
   }


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D60055.193040.patch
Type: text/x-patch
Size: 1025 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20190401/d2b30f28/attachment-0001.bin>