[clang][Sema] Fix crash when diagnosing candidates with parameter packs

[kadircet]

Prevent OOB access.

Fixes #93076

[llvmbot]

@llvm/pr-subscribers-clang

Author: kadir çetinkaya (kadircet)

Changes

Prevent OOB access.

Fixes #93076

---

Full diff: https://github.com/llvm/llvm-project/pull/93079.diff

2 Files Affected:

• (modified) clang/lib/Sema/SemaOverload.cpp (+3-2)
• (modified) clang/test/SemaCXX/overload-template.cpp (+3)

diff --git a/clang/lib/Sema/SemaOverload.cpp b/clang/lib/Sema/SemaOverload.cpp
index 2eb25237a0de6..c4f85df1ef697 100644
--- a/clang/lib/Sema/SemaOverload.cpp
+++ b/clang/lib/Sema/SemaOverload.cpp
@@ -11298,8 +11298,9 @@ static void DiagnoseBadConversion(Sema &S, OverloadCandidate *Cand,
   Expr *FromExpr = Conv.Bad.FromExpr;
   QualType FromTy = Conv.Bad.getFromType();
   QualType ToTy = Conv.Bad.getToType();
-  SourceRange ToParamRange =
-      !isObjectArgument ? Fn->getParamDecl(I)->getSourceRange() : SourceRange();
+  SourceRange ToParamRange;
+  if (!isObjectArgument && I < Fn->getNumParams())
+    ToParamRange = Fn->getParamDecl(I)->getSourceRange();
 
   if (FromTy == S.Context.OverloadTy) {
     assert(FromExpr && "overload set argument came from implicit argument?");
diff --git a/clang/test/SemaCXX/overload-template.cpp b/clang/test/SemaCXX/overload-template.cpp
index 0fe13c479cce2..01cfe87a05831 100644
--- a/clang/test/SemaCXX/overload-template.cpp
+++ b/clang/test/SemaCXX/overload-template.cpp
@@ -58,3 +58,6 @@ namespace overloadCheck{
   }
 }
 #endif
+
+template <typename ...a> int b(a...); // expected-note {{candidate function template not viable: no known conversion from 'int ()' to 'int' for 2nd argument}}
+int d() { return b<int, int>(0, d); } // expected-error {{no matching function for call to 'b'}}

[shafik]

Thank you for the fix. Can you please a little more details to your summary so that folks reading git log have more context.

This also needs a release note.

Please also add that this also fixes: #76354

[shafik]

Can you also confirm this fixes: #70191

[github-actions]

✅ With the latest revision this PR passed the C/C++ code formatter.

[kadircet]

@shafik thx for the pointers, i didn't know this came up before and even there were attempted fixes. I can verify that both of those are also fixed with this patch.

@knightXun do you plan to proceed with #70280 ? If so I am happy to discard this PR in favor of yours.

[mizvekov]

Can you also add a test based on my example?

With also a variant on that in which the bad conversion happens on the last element of the pack, instead of the last parameter.

Lastly, please namespace the tests with the name of, or add a comment naming, the GitHub issue.

Otherwise, LGTM.