[clang] [clang][Sema] Fix crash when diagnosing candidates with parameter packs (PR #93079)

[kadir çetinkaya via cfe-commits]

https://github.com/kadircet created https://github.com/llvm/llvm-project/pull/93079

Prevent OOB access.

Fixes https://github.com/llvm/llvm-project/issues/93076


>From 7840ea2b16863ee7057f3b1239c59b6be06cbd42 Mon Sep 17 00:00:00 2001
From: Kadir Cetinkaya <kadircet at google.com>
Date: Wed, 22 May 2024 19:37:18 +0200
Subject: [PATCH] [clang][Sema] Fix crash when diagnosing candidates with
 parameter packs

Prevent OOB access.

Fixes https://github.com/llvm/llvm-project/issues/93076
---
 clang/lib/Sema/SemaOverload.cpp          | 5 +++--
 clang/test/SemaCXX/overload-template.cpp | 3 +++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/clang/lib/Sema/SemaOverload.cpp b/clang/lib/Sema/SemaOverload.cpp
index 2eb25237a0de6..c4f85df1ef697 100644
--- a/clang/lib/Sema/SemaOverload.cpp
+++ b/clang/lib/Sema/SemaOverload.cpp
@@ -11298,8 +11298,9 @@ static void DiagnoseBadConversion(Sema &S, OverloadCandidate *Cand,
   Expr *FromExpr = Conv.Bad.FromExpr;
   QualType FromTy = Conv.Bad.getFromType();
   QualType ToTy = Conv.Bad.getToType();
-  SourceRange ToParamRange =
-      !isObjectArgument ? Fn->getParamDecl(I)->getSourceRange() : SourceRange();
+  SourceRange ToParamRange;
+  if (!isObjectArgument && I < Fn->getNumParams())
+    ToParamRange = Fn->getParamDecl(I)->getSourceRange();
 
   if (FromTy == S.Context.OverloadTy) {
     assert(FromExpr && "overload set argument came from implicit argument?");
diff --git a/clang/test/SemaCXX/overload-template.cpp b/clang/test/SemaCXX/overload-template.cpp
index 0fe13c479cce2..01cfe87a05831 100644
--- a/clang/test/SemaCXX/overload-template.cpp
+++ b/clang/test/SemaCXX/overload-template.cpp
@@ -58,3 +58,6 @@ namespace overloadCheck{
   }
 }
 #endif
+
+template <typename ...a> int b(a...); // expected-note {{candidate function template not viable: no known conversion from 'int ()' to 'int' for 2nd argument}}
+int d() { return b<int, int>(0, d); } // expected-error {{no matching function for call to 'b'}}