[gcc r12-5294] waccess: Fix up pass_waccess::check_alloc_size_call [PR102009]

[gcc r12-5294] waccess: Fix up pass_waccess::check_alloc_size_call [PR102009]

[Jakub Jelinek]

https://gcc.gnu.org/g:eacdfaf7ca07367ede1a0c50aa997953958dabae

commit r12-5294-geacdfaf7ca07367ede1a0c50aa997953958dabae
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Nov 16 10:18:25 2021 +0100

    waccess: Fix up pass_waccess::check_alloc_size_call [PR102009]
    
    This function punts if the builtins have no arguments, but as can be seen
    on the testcase, even if it has some arguments but alloc_size attribute's
    arguments point to arguments that aren't passed, we get a warning earlier
    from the FE but should punt rather than ICE on it.
    Other users of alloc_size attribute e.g. in
    tree-object-size.c (alloc_object_size) punt similarly and similarly
    even in the same TU maybe_warn_nonstring_arg correctly verifies calls have
    enough arguments.
    
    2021-11-16  Jakub Jelinek  <jakub@redhat.com>
    
            PR tree-optimization/102009
            * gimple-ssa-warn-access.cc (pass_waccess::check_alloc_size_call):
            Punt if any of alloc_size arguments is out of bounds vs. number of
            call arguments.
    
            * gcc.dg/pr102009.c: New test.

Diff:
---
 gcc/gimple-ssa-warn-access.cc   | 10 ++++++----
 gcc/testsuite/gcc.dg/pr102009.c | 10 ++++++++++
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/gcc/gimple-ssa-warn-access.cc b/gcc/gimple-ssa-warn-access.cc
index 073f122af31..22c791d833a 100644
--- a/gcc/gimple-ssa-warn-access.cc
+++ b/gcc/gimple-ssa-warn-access.cc
@@ -2335,10 +2335,6 @@ pass_waccess::check_alloca (gcall *stmt)
 void
 pass_waccess::check_alloc_size_call (gcall *stmt)
 {
-  if (gimple_call_num_args (stmt) < 1)
-    /* Avoid invalid calls to functions without a prototype.  */
-    return;
-
   tree fndecl = gimple_call_fndecl (stmt);
   if (fndecl && gimple_call_builtin_p (stmt, BUILT_IN_NORMAL))
     {
@@ -2367,13 +2363,19 @@ pass_waccess::check_alloc_size_call (gcall *stmt)
      the actual argument(s) at those indices in ALLOC_ARGS.  */
   int idx[2] = { -1, -1 };
   tree alloc_args[] = { NULL_TREE, NULL_TREE };
+  unsigned nargs = gimple_call_num_args (stmt);
 
   tree args = TREE_VALUE (alloc_size);
   idx[0] = TREE_INT_CST_LOW (TREE_VALUE (args)) - 1;
+  /* Avoid invalid calls to functions without a prototype.  */
+  if ((unsigned) idx[0] >= nargs)
+    return;
   alloc_args[0] = call_arg (stmt, idx[0]);
   if (TREE_CHAIN (args))
     {
       idx[1] = TREE_INT_CST_LOW (TREE_VALUE (TREE_CHAIN (args))) - 1;
+      if ((unsigned) idx[1] >= nargs)
+	return;
       alloc_args[1] = call_arg (stmt, idx[1]);
     }
 
diff --git a/gcc/testsuite/gcc.dg/pr102009.c b/gcc/testsuite/gcc.dg/pr102009.c
new file mode 100644
index 00000000000..5b3a39bd0db
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/pr102009.c
@@ -0,0 +1,10 @@
+/* PR tree-optimization/102009 */
+/* { dg-do compile } */
+
+void *realloc ();	/* { dg-message "declared here" } */
+
+void *
+foo (void *p)
+{
+  return realloc (p);	/* { dg-warning "too few arguments to built-in function 'realloc' expecting " } */
+}