[PATCH 3/3] Fix bounds checks in the callback_only attribute handler.

[Josef Melcr]

The attribute handler for callback_only currently doesn't detect
negative indices in the attribute's arguments, which is not intended.
This patch fixes that.

Best regards,
Josef

gcc/c-family/ChangeLog:

        * c-attribs.cc (handle_callback_only_attribute): Fix various
        bounds checks.

Signed-off-by: Josef Melcr <josef.me...@suse.com>
---
 gcc/c-family/c-attribs.cc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/gcc/c-family/c-attribs.cc b/gcc/c-family/c-attribs.cc
index 1ed02850a91..2fa6330e654 100644
--- a/gcc/c-family/c-attribs.cc
+++ b/gcc/c-family/c-attribs.cc
@@ -4716,10 +4716,11 @@ handle_callback_only_attribute (tree *node, tree name, 
tree args,
       return NULL_TREE;
     }
   --callback_fn_idx;
-  if (callback_fn_idx >= decl_nargs)
+  if (callback_fn_idx < 0 || callback_fn_idx >= decl_nargs)
     {
       error_at (DECL_SOURCE_LOCATION (decl),
-               "callback function position out of range");
+               "callback function index %d is out of range",
+               callback_fn_idx + 1);
       *no_add_attrs = true;
       return NULL_TREE;
     }
@@ -4793,7 +4794,7 @@ handle_callback_only_attribute (tree *node, tree name, 
tree args,
       arg_idx -= 1;
       /* Report an error if the position is out of bounds,
         but we can still check the rest of the arguments.  */
-      if (arg_idx >= decl_nargs)
+      if (arg_idx < 0 || arg_idx >= decl_nargs)
        {
          error_at (DECL_SOURCE_LOCATION (decl),
                    "callback argument index %d is out of range", arg_idx + 1);
-- 
2.55.0