[clang][Sema] Fix crash when diagnosing candidates with parameter packs

Prevent OOB access.

Fixes #93076

Author: kadircet

clang/lib/Sema/SemaOverload.cpp

@@ -11298,8 +11298,9 @@ static void DiagnoseBadConversion(Sema &S, OverloadCandidate *Cand,
   Expr *FromExpr = Conv.Bad.FromExpr;
   QualType FromTy = Conv.Bad.getFromType();
   QualType ToTy = Conv.Bad.getToType();
-  SourceRange ToParamRange =
-      !isObjectArgument ? Fn->getParamDecl(I)->getSourceRange() : SourceRange();
+  SourceRange ToParamRange;
+  if (!isObjectArgument && I < Fn->getNumParams())
+    ToParamRange = Fn->getParamDecl(I)->getSourceRange();
 
   if (FromTy == S.Context.OverloadTy) {
     assert(FromExpr && "overload set argument came from implicit argument?");

clang/test/SemaCXX/overload-template.cpp

@@ -58,3 +58,6 @@ namespace overloadCheck{
   }
 }
 #endif
+
+template <typename ...a> int b(a...); // expected-note {{candidate function template not viable: no known conversion from 'int ()' to 'int' for 2nd argument}}
+int d() { return b<int, int>(0, d); } // expected-error {{no matching function for call to 'b'}}