Check i < FD->getNumParams() before querying

Summary:
As was already stated in a previous comment, the parameter isn't
necessarily referring to one of the DeclContext's parameter. We
should check the index is within the range to avoid out-of-boundary
access.

Reviewers: gribozavr, rsmith, lebedev.ri

Reviewed By: gribozavr, rsmith

Subscribers: lebedev.ri, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D60055

Patch by Violet.

llvm-svn: 358134

3 files changed, 25 insertions, 1 deletions

diff --git a/clang/lib/Sema/SemaTemplateInstantiate.cpp b/clang/lib/Sema/SemaTemplateInstantiate.cpp
index a7d03dd..e8f1dcc 100644
--- a/clang/lib/Sema/SemaTemplateInstantiate.cpp
+++ b/clang/lib/Sema/SemaTemplateInstantiate.cpp
@@ -2892,7 +2892,7 @@ static const Decl *getCanonicalParmVarDecl(const Decl *D) {
       unsigned i = PV->getFunctionScopeIndex();
       // This parameter might be from a freestanding function type within the
       // function and isn't necessarily referring to one of FD's parameters.
-      if (FD->getParamDecl(i) == PV)
+      if (i < FD->getNumParams() && FD->getParamDecl(i) == PV)
         return FD->getCanonicalDecl()->getParamDecl(i);
     }
   }
diff --git a/clang/test/SemaCXX/PR41139.cpp b/clang/test/SemaCXX/PR41139.cpp
new file mode 100644
index 0000000..e120e42
--- /dev/null
+++ b/clang/test/SemaCXX/PR41139.cpp
@@ -0,0 +1,15 @@
+// RUN: %clang_cc1 -fsyntax-only -std=c++17 -verify %s
+
+// expected-no-diagnostics
+
+// This test should not crash.
+int f1( unsigned ) { return 0; }
+
+template <class R, class... Args>
+struct S1 {
+    S1( R(*f)(Args...) ) {}
+};
+
+int main() {
+    S1 s1( f1 );
+}
diff --git a/clang/test/SemaCXX/cxx1y-generic-lambdas.cpp b/clang/test/SemaCXX/cxx1y-generic-lambdas.cpp
index 7c3b970..0879823 100644
--- a/clang/test/SemaCXX/cxx1y-generic-lambdas.cpp
+++ b/clang/test/SemaCXX/cxx1y-generic-lambdas.cpp
@@ -944,6 +944,15 @@ namespace PR22117 {
   }(0)(0);
 }
 
+namespace PR41139 {
+  int y = [](auto outer) {
+    return [](auto inner) {
+      using T = int(decltype(outer), decltype(inner));
+      return 0;
+    };
+  }(0)(0);
+}
+
 namespace PR23716 {
 template<typename T>
 auto f(T x) {