[clang] [clang][Sema] Fix crash when checking scalar type with excess braces (PR #192471)

[via cfe-commits]

https://github.com/tobiichi3227 updated https://github.com/llvm/llvm-project/pull/192471

>From 4129aef5f16aac3a5b70f1efb890d17d1702358c Mon Sep 17 00:00:00 2001
From: tobiichi3227 <cz1346219 at gmail.com>
Date: Thu, 16 Apr 2026 22:43:04 +0800
Subject: [PATCH 1/3] [clang][Sema] Fix crash when checking scalar type with
 excess braces

`InitListChecker::CheckScalarType()` crashed with multiple nested braces
in scalar initializers (e.g., `int v = {{}, {}, {}};`) due to out-of-bounds
access when retrieving diagnostic location from uninitialized StructuredList.

Add bounds checking before `getInit(0)` access and add regression test
---
 clang/lib/Sema/SemaInit.cpp | 17 +++++++++++------
 clang/test/Sema/init.c      |  3 +++
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/clang/lib/Sema/SemaInit.cpp b/clang/lib/Sema/SemaInit.cpp
index e54a25405c816..f582bb5d85ff0 100644
--- a/clang/lib/Sema/SemaInit.cpp
+++ b/clang/lib/Sema/SemaInit.cpp
@@ -1360,26 +1360,32 @@ void InitListChecker::CheckExplicitInitList(const InitializedEntity &Entity,
   // Don't complain for incomplete types, since we'll get an error elsewhere.
   if ((Index < IList->getNumInits() || CurEmbed) && !T->isIncompleteType()) {
     // We have leftover initializers
+    Expr *ExtraInit = Index < IList->getNumInits() ? IList->getInit(Index)
+                                                   : CurEmbed;
+    SourceLocation ExtraInitLoc =
+        ExtraInit ? ExtraInit->getBeginLoc() : IList->getEndLoc();
+    SourceRange ExtraInitRange =
+        ExtraInit ? ExtraInit->getSourceRange() : IList->getSourceRange();
     bool ExtraInitsIsError = SemaRef.getLangOpts().CPlusPlus ||
           (SemaRef.getLangOpts().OpenCL && T->isVectorType());
     hadError = ExtraInitsIsError;
     if (VerifyOnly) {
       return;
     } else if (StructuredIndex == 1 &&
+               StructuredList->getNumInits() != 0 &&
+               StructuredList->getInit(0) &&
                IsStringInit(StructuredList->getInit(0), T, SemaRef.Context) ==
                    SIF_None) {
       unsigned DK =
           ExtraInitsIsError
               ? diag::err_excess_initializers_in_char_array_initializer
               : diag::ext_excess_initializers_in_char_array_initializer;
-      SemaRef.Diag(IList->getInit(Index)->getBeginLoc(), DK)
-          << IList->getInit(Index)->getSourceRange();
+      SemaRef.Diag(ExtraInitLoc, DK) << ExtraInitRange;
     } else if (T->isSizelessBuiltinType()) {
       unsigned DK = ExtraInitsIsError
                         ? diag::err_excess_initializers_for_sizeless_type
                         : diag::ext_excess_initializers_for_sizeless_type;
-      SemaRef.Diag(IList->getInit(Index)->getBeginLoc(), DK)
-          << T << IList->getInit(Index)->getSourceRange();
+      SemaRef.Diag(ExtraInitLoc, DK) << T << ExtraInitRange;
     } else {
       int initKind = T->isArrayType()    ? 0
                      : T->isVectorType() ? 1
@@ -1390,8 +1396,7 @@ void InitListChecker::CheckExplicitInitList(const InitializedEntity &Entity,
 
       unsigned DK = ExtraInitsIsError ? diag::err_excess_initializers
                                       : diag::ext_excess_initializers;
-      SemaRef.Diag(IList->getInit(Index)->getBeginLoc(), DK)
-          << initKind << IList->getInit(Index)->getSourceRange();
+      SemaRef.Diag(ExtraInitLoc, DK) << initKind << ExtraInitRange;
     }
   }
 
diff --git a/clang/test/Sema/init.c b/clang/test/Sema/init.c
index cf3788bc21c93..2c544b7fdd0e2 100644
--- a/clang/test/Sema/init.c
+++ b/clang/test/Sema/init.c
@@ -204,3 +204,6 @@ union PR4517_u {
 const union PR4517_u u1 = {4.0f};
 const union PR4517_u u2 = u1; // no-warning
 const union PR4517_u u3 = {u1.y}; // expected-error {{initializer element is not a compile-time constant}}
+
+int PR192471_1 = {{}, {}, {}}; // expected-warning {{too many braces around scalar initializer}} expected-warning {{excess elements in scalar initializer}}
+char PR192471_2 = {"1110", "3227"}; // expected-warning {{excess elements in char array initializer}}
\ No newline at end of file

>From 4033cd401fff56e74435f74856cc5281e5adc569 Mon Sep 17 00:00:00 2001
From: tobiichi3227 <cz1346219 at gmail.com>
Date: Sun, 26 Apr 2026 08:58:10 +0800
Subject: [PATCH 2/3] [clang] Add release note entry

---
 clang/docs/ReleaseNotes.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index 4bea29f4c1eb6..f74d2397414ee 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -434,6 +434,7 @@ Bug Fixes in This Version
 - Fixed incorrect rejection of ``auto`` with reordered declaration specifiers in C23. (#GH164121)
 - Fixed a crash where constexpr evaluation encountered invalid overrides. (#GH183290)
 - Fixed a crash when assigning to an element of an ``ext_vector_type`` with ``bool`` element type. (#GH189260)
+- Fixed a crash when checking scalar type with excess braces. (#GH192471)
 
 Bug Fixes to Compiler Builtins
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

>From 18522e24d24bb2dcfbb2d14991db7150913a5036 Mon Sep 17 00:00:00 2001
From: tobiichi3227 <86729076+tobiichi3227 at users.noreply.github.com>
Date: Thu, 30 Apr 2026 19:46:12 +0800
Subject: [PATCH 3/3] Remove GH number in ReleaseNote

Co-authored-by: Mariya Podchishchaeva <mariya.podchishchaeva at intel.com>
---
 clang/docs/ReleaseNotes.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index f74d2397414ee..8d27130b04eb9 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -434,7 +434,7 @@ Bug Fixes in This Version
 - Fixed incorrect rejection of ``auto`` with reordered declaration specifiers in C23. (#GH164121)
 - Fixed a crash where constexpr evaluation encountered invalid overrides. (#GH183290)
 - Fixed a crash when assigning to an element of an ``ext_vector_type`` with ``bool`` element type. (#GH189260)
-- Fixed a crash when checking scalar type with excess braces. (#GH192471)
+- Fixed a crash when checking scalar type with excess braces.
 
 Bug Fixes to Compiler Builtins
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^