[clang] Fix crash when parsing scanf format string with missing arguments

[serge-sans-paille]

Summary

When parsing a format string with less argument than specified, one should check
argument access because there may be no such argument.

This fixes #57517

[inclyc]

Thanks @serge-sans-paille! Basically LGTM. Maybe we need to backport this patch though? @aaron.ballman

[aaron.ballman]

LGTM!

In D133197#3766797, @inclyc wrote:

Thanks @serge-sans-paille! Basically LGTM. Maybe we need to backport this patch though? @aaron.ballman

Clang 15 is closed for backports that aren't critical at this point AFAIK (we're slated to release Clang 15 in a few days). I believe this isn't fixing a recent regression, so the change should also have a release note.

[alexander-shaposhnikov]

LG

clang/lib/Sema/SemaChecking.cpp

if (Index < FD->getNumParams()) {
         BOSType = POS->getType();
     }
 
     Optional<unsigned> IndexOptional = TranslateIndex(Index);
     if (!IndexOptional)
       return llvm::None;
     unsigned NewIndex = *IndexOptional;
 
+    if (NewIndex >= TheCall->getNumArgs())
+      return llvm::None;
+
     const Expr *ObjArg = TheCall->getArg(NewIndex);
     uint64_t Result;
     if (!ObjArg->tryEvaluateObjectSize(Result, getASTContext(), BOSType))
       return llvm::None;
 
     // Get the object size in the target's size_t width.
     return llvm::APSInt::getUnsigned(Result).extOrTrunc(SizeTypeWidth);
   };

clang/test/Sema/format-strings-scanf.c

 
 void bad_length_modifiers(char *s, void *p, wchar_t *ws, long double *ld) {
   scanf("%hhs", "foo"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
   scanf("%1$zp", &p); // expected-warning{{length modifier 'z' results in undefined behavior or no effect with 'p' conversion specifier}}
   scanf("%ls", ws); // no-warning
   scanf("%#.2Lf", ld); // expected-warning{{invalid conversion specifier '#'}}
 }
 
+void missing_argument_with_length_modifier() {
+  char buf[30];
+  scanf("%s:%900s", buf); // expected-warning{{more '%' conversions than data arguments}}
+}
+
 // Test that the scanf call site is where the warning is attached.  If the
 // format string is somewhere else, point to it in a note.
 void pr9751(void) {
   int *i;
   char str[100];
   const char kFormat1[] = "%00d"; // expected-note{{format string is defined here}}}
   scanf(kFormat1, i); // expected-warning{{zero field width in scanf format string is unused}}
   scanf("%00d", i); // expected-warning{{zero field width in scanf format string is unused}}