waccess: Fix up pass_waccess::check_alloc_size_call [PR102009]

This function punts if the builtins have no arguments, but as can be seen
on the testcase, even if it has some arguments but alloc_size attribute's
arguments point to arguments that aren't passed, we get a warning earlier
from the FE but should punt rather than ICE on it.
Other users of alloc_size attribute e.g. in
tree-object-size.c (alloc_object_size) punt similarly and similarly
even in the same TU maybe_warn_nonstring_arg correctly verifies calls have
enough arguments.

2021-11-16  Jakub Jelinek  <jakub@redhat.com>

	PR tree-optimization/102009
	* gimple-ssa-warn-access.cc (pass_waccess::check_alloc_size_call):
	Punt if any of alloc_size arguments is out of bounds vs. number of
	call arguments.

	* gcc.dg/pr102009.c: New test.

2 files changed, 16 insertions, 4 deletions

diff --git a/gcc/gimple-ssa-warn-access.cc b/gcc/gimple-ssa-warn-access.cc
index 073f122..22c791d 100644
--- a/gcc/gimple-ssa-warn-access.cc
+++ b/gcc/gimple-ssa-warn-access.cc
@@ -2335,10 +2335,6 @@ pass_waccess::check_alloca (gcall *stmt)
 void
 pass_waccess::check_alloc_size_call (gcall *stmt)
 {
-  if (gimple_call_num_args (stmt) < 1)
-    /* Avoid invalid calls to functions without a prototype.  */
-    return;
-
   tree fndecl = gimple_call_fndecl (stmt);
   if (fndecl && gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
     {
@@ -2367,13 +2363,19 @@ pass_waccess::check_alloc_size_call (gcall *stmt)
      the actual argument(s) at those indices in ALLOC_ARGS.  */
   int idx[2] = { -1, -1 };
   tree alloc_args[] = { NULL_TREE, NULL_TREE };
+  unsigned nargs = gimple_call_num_args (stmt);
 
   tree args = TREE_VALUE (alloc_size);
   idx[0] = TREE_INT_CST_LOW (TREE_VALUE (args)) - 1;
+  /* Avoid invalid calls to functions without a prototype.  */
+  if ((unsigned) idx[0] >= nargs)
+    return;
   alloc_args[0] = call_arg (stmt, idx[0]);
   if (TREE_CHAIN (args))
     {
       idx[1] = TREE_INT_CST_LOW (TREE_VALUE (TREE_CHAIN (args))) - 1;
+      if ((unsigned) idx[1] >= nargs)
+	return;
       alloc_args[1] = call_arg (stmt, idx[1]);
     }
 
diff --git a/gcc/testsuite/gcc.dg/pr102009.c b/gcc/testsuite/gcc.dg/pr102009.c
new file mode 100644
index 0000000..5b3a39b
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/pr102009.c
@@ -0,0 +1,10 @@
+/* PR tree-optimization/102009 */
+/* { dg-do compile } */
+
+void *realloc ();	/* { dg-message "declared here" } */
+
+void *
+foo (void *p)
+{
+  return realloc (p);	/* { dg-warning "too few arguments to built-in function 'realloc' expecting " } */
+}