Index: lib/Sema/SemaDeclAttr.cpp
===================================================================
--- lib/Sema/SemaDeclAttr.cpp
+++ lib/Sema/SemaDeclAttr.cpp
@@ -4567,11 +4567,10 @@
   bool IsPointer = AL.getName()->getName() == "pointer_with_type_tag";
   if (IsPointer) {
     // Ensure that buffer has a pointer type.
-    QualType BufferTy = getFunctionOrMethodParamType(D, ArgumentIdx);
-    if (!BufferTy->isPointerType()) {
+    if (ArgumentIdx >= getFunctionOrMethodNumParams(D) ||
+        !getFunctionOrMethodParamType(D, ArgumentIdx)->isPointerType())
       S.Diag(AL.getLoc(), diag::err_attribute_pointers_only)
-        << AL.getName() << 0;
-    }
+          << AL.getName() << 0;
   }
 
   D->addAttr(::new (S.Context) ArgumentWithTypeTagAttr(
Index: test/Sema/warn-type-safety.c
===================================================================
--- test/Sema/warn-type-safety.c
+++ test/Sema/warn-type-safety.c
@@ -37,6 +37,10 @@
 int wrong10(double buf, MPI_Datatype type)
     __attribute__(( pointer_with_type_tag(mpi,1,2) )); // expected-error {{'pointer_with_type_tag' attribute only applies to pointer arguments}}
 
+int ok11(void *, ...)
+    __attribute__(( pointer_with_type_tag(mpi,1,2) ));
+int wrong11(void *, ...)
+    __attribute__(( pointer_with_type_tag(mpi,2,3) )); // expected-error {{'pointer_with_type_tag' attribute only applies to pointer arguments}}
 
 extern struct A datatype_wrong1
     __attribute__(( type_tag_for_datatype )); // expected-error {{'type_tag_for_datatype' attribute requires parameter 1 to be an identifier}}